5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An employee receives a direct message on a social media platform from someone claiming to be the company's IT director. The message says the employee's account has been flagged and they need to 'verify their identity' by providing their username and password. What should the employee do?

   • AIgnore the message because social media is not a legitimate channel for IT requests.
   • BReport the message to the security team and do not provide any information.
   • CReply to the message asking for a phone number to call and verify.
   • DProvide the requested information because the IT director has authority.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A help desk technician receives an email that appears to be from a senior manager, asking for a list of all employees' phone numbers 'for a company-wide directory update.' The email includes the manager's signature and a link to a shared document. The technician notices the sender's email address is slightly misspelled (e.g., 'manager@cornpany.com' instead of 'manager@company.com'). What should the technician do?

   • AReport the email to the security team and do not share the information until the request is verified through a known contact method.
   • BForward the email to the manager's actual email address and ask if they sent it.
   • CReply to the email asking the manager to confirm the request before sending the list.
   • DClick the link to see if the document is legitimate before deciding whether to share the list.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A help desk technician receives a call from someone claiming to be a new employee who needs a laptop set up. The caller provides a name and a department, but the technician cannot find the employee in the directory. The caller says they were just hired and the directory is not updated yet. What should the technician do?

   • ASet up the laptop but restrict access until the employee is verified.
   • BPolitely explain that the technician cannot find the employee and ask the caller to have their manager submit a request through the ticketing system.
   • CAsk for a supervisor's name and contact information.
   • DSet up the laptop because the caller has a name and department.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An employee receives an email that appears to be from the company's IT department, asking them to 'update their email password' by clicking a link. The email's sender address is 'it-support@company.com' but the link in the email points to 'http://company-support-login.com'. What should the employee do?

   • AClick the link and enter their current password to see if the page is legitimate.
   • BIgnore the email because IT never sends password update requests.
   • CForward the email to the IT department's official email address and ask if it is legitimate.
   • DReport the email to the security team and do not click the link.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A person in a uniform claiming to be from the company's contracted printer vendor appears at the help desk and asks to 'test' the network ports in the server room. The technician does not have a work order for this visit. What should the technician do?

   • AEscort the person to the server room to avoid delaying service.
   • BAsk for identification and call the vendor's known contact to verify the visit.
   • CLet the person in but watch them closely.
   • DAsk the person to return tomorrow when the manager is available.
   Reveal Solution Discussion Select an answer first