2.7 Describe Social Engineering Attacks (manual and Generative AI) 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is planning a social engineering attack against a target organization. The tester has limited time and budget. The goal is to obtain credentials from a specific employee in the finance department. Which approach would be most effective given the constraints?

   • ACall the employee pretending to be IT support.
   • BConduct targeted reconnaissance on the employee and craft a spear phishing email using personal details.
   • CDeploy a USB drop in the parking lot.
   • DSend a mass phishing email to all employees.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Before launching a manual social engineering attack, an attacker gathers information about the target's job role, interests, and social connections. What is this phase called?

   • AReconnaissance
   • BPost-exploitation
   • CExploitation
   • DDelivery
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A financial firm has a strict policy that all wire transfers require verbal confirmation from the CFO. An attacker uses a deepfake audio of the CFO's voice to call an employee and authorize a transfer. The employee recognizes the voice and processes the transfer. Which additional control would have most likely prevented this attack?

   • ARecording all phone calls for later review
   • BUsing a voice recognition system to authenticate the CFO
   • CTraining employees to listen for robotic tones
   • DRequiring a callback to a known number for verification
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company wants to implement a defense-in-depth strategy against social engineering. They have a limited budget and must choose between advanced email filtering and comprehensive user training. Which approach is most effective?

   • AA combination of email filtering and user training
   • BComprehensive user training only
   • CAdvanced email filtering only
   • DImplementing a strict verification protocol for all requests
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is conducting a social engineering assessment. The tester has gathered detailed information about the target, including their daily schedule and preferred coffee shop. Which technique would be most effective to use this information in a manual attack?

   • APretexting by posing as a colleague at the coffee shop to obtain information.
   • BCalling the target's home phone number.
   • CSending a mass phishing email to all employees.
   • DLeaving a USB drive at the coffee shop.
   Reveal Solution Discussion Select an answer first