5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A user receives an email that appears to be from their bank, warning of suspicious activity and asking them to click a link to 'verify their account.' The user is concerned but also knows that phishing emails exist. The user wants to confirm whether the email is legitimate without risking their account. What is the best action?

   • AClick the link and check if the website looks legitimate before entering any information.
   • BReply to the email asking the bank to confirm the request.
   • CContact the bank directly using the phone number on the back of their debit card or the official website.
   • DForward the email to the bank's customer service address and ask if it is legitimate.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A person claiming to be an external auditor arrives at the office and asks a receptionist to let them into the server room to 'perform a compliance check.' The receptionist does not recognize the person and no visit was scheduled. What should the receptionist do?

   • ALet the auditor in because they have a badge and seem professional.
   • BEscort the auditor to the server room and stay with them while they work.
   • CAsk the auditor for their driver's license and then allow access.
   • DDeny access and contact the IT manager or the person who would have scheduled the audit to verify the visit.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A user receives a phone call from someone claiming to be from 'Microsoft Support' who says the user's computer has a virus and needs immediate remote access to fix it. The caller asks the user to install a remote-access tool and provide the session code. What should the user do?

   • AAsk the caller for their employee ID and then allow remote access if they provide one.
   • BInstall the remote-access tool but do not give the session code until the user runs a virus scan.
   • CProvide the session code so the technician can remove the virus quickly.
   • DHang up and contact their organization's IT help desk to verify whether the call is legitimate.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has a 'zero trust' policy that requires verification for every access request. A help desk technician receives a call from a user who is traveling and needs a password reset. The user cannot answer security questions because they are in a hurry. The technician has the user's phone number on file. What is the best action?

   • AAsk the user to answer security questions later.
   • BCall the user back on the number on file to verify.
   • CSend a temporary password to the user's personal email.
   • DReset the password because the user is traveling and needs access.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A help desk technician receives a call from a user who is 'working from home' and needs a password reset. The caller provides the user's employee ID and answers the security questions correctly. However, the technician notices the caller's phone number is not the one on file for the user. What should the technician do?

   • AReset the password because the security questions were answered correctly.
   • BRefuse the reset and hang up.
   • CAsk for additional verification, such as a manager approval or callback to the number on file.
   • DReset the password but note the phone number discrepancy.
   Reveal Solution Discussion Select an answer first