5.2. Recognize How to Avoid Becoming a Victim of Social Engineering Attacks. 100-140 Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A company has a policy that all IT support calls must be verified with a callback to a known number. However, a help desk technician receives a call from someone claiming to be the CEO, who is traveling abroad and says they cannot receive calls on their known number. The caller demands an immediate password reset to access a critical presentation. The technician must balance the security policy with the urgency of the request. What is the best course of action?

   • AReset the password and then immediately report the incident to the security team.
   • BExplain the policy and ask the caller to verify through an alternative method, such as a video call with the IT manager or a one-time code sent to a secondary device on file.
   • CAsk the caller to verify their identity by providing a colleague's name and then reset the password.
   • DReset the password because the caller claims to be the CEO and the request is urgent.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A person claiming to be a senior executive calls the help desk, demanding that a password be reset immediately for an 'urgent client meeting.' The caller is impatient and threatens to report the technician for delaying business. The technician does not recognize the voice. What should the technician do?

   • AFollow the standard identity-verification procedure before making any changes.
   • BReset the password immediately to avoid escalation.
   • CAsk the caller to send an email from their corporate account and then reset.
   • DTransfer the call to the executive's assistant for confirmation.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A user receives an email with a link to a website that looks exactly like the company's internal portal, but the URL is 'http://portal.company.com.verify-login.info'. The email warns of a 'security update' and asks the user to log in. What is the most likely threat, and what should the user do?

   • AIt is a phishing attempt; report the email and do not click the link.
   • BIt is a legitimate security update; click the link and log in.
   • CIt is a vishing attempt; call the number in the email.
   • DIt is a smishing attempt; reply with a text.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is experiencing a rise in phishing attacks. The security team wants to implement a control that will have the most immediate impact on reducing the success of phishing emails. The company has a limited budget and cannot afford a full security awareness training program. Which control is most effective?

   • ASend a one-time email warning to all users.
   • BImplement email filtering and URL sandboxing.
   • CRequire users to change passwords every 30 days.
   • DDisable all email links and require users to type URLs manually.
   Reveal Solution Discussion Select an answer first