5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A help desk technician receives an email that appears to be from the company's security team, asking all technicians to 'verify' their credentials by clicking a link to a login page. The email has a sense of urgency and a link that looks similar to the company's internal portal but is not the exact URL. What should the technician do?

   • AClick the link and log in to verify credentials.
   • BForward the email to the security team's known address and ask if it is legitimate.
   • CReply to the email asking for confirmation.
   • DDelete the email and change the password.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An employee receives a phone call from someone claiming to be from the company's IT help desk, saying that the employee's account has been compromised and they need to 'verify' their password immediately. The caller knows the employee's full name and job title. What should the employee do?

   • AFollow the caller's instructions to avoid account lockout.
   • BAsk the caller for their employee ID before proceeding.
   • CProvide the password to verify the account.
   • DHang up and call the IT help desk using the official number.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A help desk technician is frequently targeted by social engineers because of their access to user accounts. The company wants to reduce this risk without making the help desk process too cumbersome for legitimate users. Which control best achieves this balance?

   • AImplement a self-service password reset portal that uses multi-factor authentication (MFA) for identity verification.
   • BDisable password resets for all users except the IT manager.
   • CRequire all password resets to be performed in person at the help desk.
   • DAllow any help desk technician to reset passwords based on the caller's name and employee ID.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A user receives a text message that appears to be from their company's IT department, stating that their account will be locked in 24 hours unless they click a link to 'verify their identity.' The user is about to leave for vacation and is concerned about losing access. What is the best action?

   • AIgnore the message because all such messages are phishing attempts.
   • BReply to the text asking for more information to confirm it is legitimate.
   • CClick the link immediately to avoid losing access while on vacation.
   • DContact the IT help desk using the number on the company intranet to verify the message before taking any action.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A person claiming to be a police officer calls the help desk, demanding that the technician provide the home address of an employee 'for an investigation.' The caller is insistent and provides a badge number. What should the technician do?

   • AProvide the information because the caller is a police officer.
   • BAsk for a court order and escalate to management.
   • CProvide the information but note the badge number.
   • DHang up and ignore the request.
   Reveal Solution Discussion Select an answer first