5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A help desk technician is responsible for handling password reset requests. The company has a policy that all requests must be verified through a callback to a known number. However, a technician receives a call from someone claiming to be a remote employee who is traveling and cannot receive calls on their known number. The caller needs a password reset to access a critical system. The technician must balance the policy with the employee's needs. What is the best course of action?

   • AReset the password because the caller is a remote employee and the request is urgent.
   • BExplain the policy and ask the caller to verify through an alternative method, such as a one-time code sent to a secondary email address on file.
   • CReset the password and then immediately report the incident to the security team.
   • DAsk the caller to verify their identity by providing their employee ID and then reset the password.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has a policy that all IT requests must be submitted through a ticketing system. An employee receives a phone call from someone claiming to be the IT director, asking the employee to 'urgently' reset a password for a new hire who 'has no email yet.' The caller says the ticket is 'being created' and pressures the employee to act now. The employee is new and wants to make a good impression. What should the employee do?

   • AReset the password but document the request for later.
   • BReset the password to help the new hire, since the caller is the IT director.
   • CAsk the caller to provide the new hire's name and then reset.
   • DPolitely explain that the policy requires a ticket and offer to help once it is created.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A user receives a text message that appears to be from their bank, asking them to verify their account number by replying with it. What type of attack is this, and what should the user do?

   • ASmishing; do not reply and contact the bank using a verified official number.
   • BPhishing; forward the message to friends to see if they received it too.
   • CVishing; call the number in the text to verify the request.
   • DSmishing; reply with the information to avoid account suspension.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A person calls claiming to be from IT support and says they need your password to fix a network issue. What is the best way to verify this caller's identity?

   • AProvide the password if the caller knows your name.
   • BAsk for their employee ID number.
   • CCheck if the caller sounds professional and knowledgeable.
   • DCall back using the official IT support number from the company directory.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An employee receives a text message that appears to be from the company's IT department, stating that their mailbox is over quota and they must click a link to 'keep their email.' The message includes a sense of urgency and a shortened URL. The employee is unsure whether to click. What should the employee do first?

   • ADelete the message and ignore it, since all such messages are phishing attempts.
   • BReply to the text asking for more details to confirm it is legitimate.
   • CClick the link to see if the page looks legitimate before entering any credentials.
   • DForward the message to the IT help desk or security team for verification before taking any action.
   Reveal Solution Discussion Select an answer first