5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An email claims to be from the CEO and urgently asks the recipient to purchase gift cards for a client. What type of social engineering attack is this, and what is the best response?

   • AVishing; call the number in the email signature.
   • BSmishing; forward the email to the IT department for analysis.
   • CImpersonation; verify the request through a known official communication channel.
   • DPhishing; reply to the email to confirm the request.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An employee receives a text message that appears to be from their bank, asking them to 'verify' a suspicious transaction by clicking a link. The employee does not have an account with that bank. What should the employee do?

   • ADelete the message and report it to the IT department.
   • BReply 'STOP' to opt out of future messages.
   • CClick the link to see what the transaction is.
   • DCall the bank's customer service number from the message.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A user receives a voicemail that appears to be from the company's IT help desk, saying their account has been compromised and they must call back a number provided in the message to 'verify their identity.' The user is unsure if the message is legitimate. What should the user do?

   • ACall the number provided in the voicemail to verify their identity and secure their account.
   • BIgnore the voicemail because all such messages are scams.
   • CReply to the voicemail by texting the number to confirm the request.
   • DCall the IT help desk using the number on the company's intranet or official directory to verify the message.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An employee receives an email that appears to be from the company's HR department, stating that their benefits enrollment has failed and they must 'verify their identity' by clicking a link and entering their username and password. The email's domain is 'hr-company.com' instead of 'company.com'. What is the most important reason the employee should not click the link?

   • AThe link might be slow to load because the HR system is overloaded.
   • BThe email could be a phishing attempt designed to steal their credentials, as indicated by the lookalike domain.
   • CThe email might contain a virus that will infect their computer just by opening it.
   • DThe HR department should not send emails about benefits, so the email is definitely fake.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company's help desk has a policy that technicians must verify a caller's identity before resetting passwords. However, a technician receives a call from someone claiming to be a high-level executive who is about to give a presentation and needs a password reset immediately. The caller refuses to go through the verification process, citing urgency. The technician must decide how to respond. What is the best response?

   • AAsk the caller to provide their employee ID and then reset the password.
   • BReset the password because the caller is an executive and the request is urgent.
   • CPolitely explain the policy and offer to verify through an alternative method, such as a callback to a known number or a one-time code sent to a registered device.
   • DReset the password and then report the incident to the security team.
   Reveal Solution Discussion Select an answer first