1.4 Describe the Controls Used to Protect Against Phishing and Social Engineering Attacks 350-701 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A regional bank's CFO received an email that appeared to come from the CEO, urgently requesting a wire transfer to a known vendor with 'updated' bank details. The email was personalized with the CFO's name and referenced a recent board meeting. Which type of phishing attack is this, and what technical control would most directly mitigate it?

   • AVishing; enforce out-of-band verification for wire transfers
   • BClone phishing; implement web filtering to block the malicious link
   • CWhaling; deploy an anti-malware solution on the CFO's workstation
   • DSpear phishing; implement DMARC and email filtering to block spoofed domains
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has a high rate of employees falling for vishing attacks. The security team wants to implement a control that is both effective and cost-efficient. Which approach would be most effective?

   • ARequire all employees to use a callback service for any sensitive request
   • BBlock all unknown numbers from reaching employees
   • CImplement a security awareness training program that includes vishing simulations and regular reinforcement
   • DDeploy a voice biometrics system to verify all callers
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An employee receives a phone call from someone claiming to be from IT, asking for their password to 'fix a network issue'. The employee suspects social engineering. What should the employee do first?

   • AAsk for a callback number and call back later
   • BReport the call to the security team and do not provide any information
   • CProvide the password but then change it immediately
   • DHang up and ignore the call
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An attacker sends a phishing email to a specific group of employees in the finance department, using their names and job titles to make the message appear legitimate. Which type of phishing attack is this?

   • AWhaling
   • BClone phishing
   • CSmishing
   • DSpear phishing
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A user receives a direct message on LinkedIn from a recruiter with a link to a fake job application page that asks for login credentials. Which type of phishing attack is this, and what control would be most effective?

   • ASmishing; deploy an anti-malware solution on the user's device
   • BSpear phishing; enforce MFA for all social media accounts
   • CPhishing via social media; use web filtering to block the malicious link
   • DVishing; implement email filtering to block the message
   Reveal Solution Discussion Select an answer first