5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard · select all that apply

   A help desk technician is on a call with a user who is requesting a password reset. The technician suspects the caller is not the legitimate user. Which of the following actions are appropriate to verify the caller's identity? (Select all that apply.)

   • AAsk the user to submit a ticket through the ticketing system.
   • BCall the user back on the phone number on file.
   • CReset the password if the caller sounds confident.
   • DAsk for the user's employee ID and date of birth.
   • EAsk the user to provide a manager's approval.
   Check answers Discussion Select an answer first
2. 22application · medium

   A help desk technician receives a call from someone claiming to be a new employee who needs their account credentials 'to start work today.' The caller says they are in a hurry and cannot access their email. The technician does not have a record of the new employee's start date. What should the technician do?

   • AVerify the caller's identity and employment status through the HR system or by contacting the hiring manager before creating any account.
   • BAsk the caller for their manager's name and then create the account.
   • CCreate the account and provide the credentials because the caller sounds legitimate.
   • DCreate a temporary account with limited access and provide the credentials.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A help desk technician receives a call from someone claiming to be a remote employee who 'forgot' their password. The caller knows the employee's name and department. The technician is about to reset the password, but the caller cannot answer the security questions. What should the technician do?

   • AAsk for the employee ID and reset if provided.
   • BSend a temporary password to the employee's personal email.
   • CReset the password anyway because the caller knows basic details.
   • DRefuse the reset and follow the escalation process for identity verification.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An employee receives a voicemail from 'Microsoft Support' stating that their computer has been sending malware and they must call back immediately to avoid a ban. The callback number is not a Microsoft support number. What should the employee do?

   • ACall Microsoft's general support line to check.
   • BCall the number to verify the issue.
   • CIgnore the voicemail and report it to the IT department.
   • DFollow the instructions to avoid the ban.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why are help desk technicians especially attractive targets for social engineering attacks?

   • AThey are required to share their login credentials with other team members.
   • BThey have the authority to approve financial transactions for the company.
   • CThey typically have access to user accounts, password resets, and internal systems.
   • DThey are the only employees who receive security awareness training.
   Reveal Solution Discussion Select an answer first