Social Engineering and Phishing CEH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is investigating a phishing email that was sent to multiple employees. The email contains a link to a website that asks for login credentials. The analyst wants to determine if any employees clicked the link and entered their credentials. Which action would provide the most direct evidence?

   • ACheck the email server logs for recipients who opened the email
   • BInterview all employees to ask if they clicked the link
   • CSearch the company's DNS logs for queries to the phishing domain
   • DReview the web server logs of the phishing site for successful form submissions
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An attacker sends a fraudulent text message to a victim's mobile phone, claiming to be from their bank and asking them to click a link. Which phishing technique is being used?

   • AVishing
   • BSmishing
   • CWhaling
   • DSpear phishing
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has a high rate of successful phishing because employees often click on links in emails. The security team wants to implement a technical control that will automatically quarantine emails with suspicious links before they reach the user's inbox. Which control is most appropriate?

   • AProvide employees with a browser extension that blocks known malicious sites.
   • BEnable multi-factor authentication (MFA) for all email accounts.
   • CDeploy an email security gateway with URL reputation and sandboxing.
   • DImplement a strict password policy with frequent changes.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security awareness trainer is explaining why employees fall for social engineering attacks. The trainer wants to emphasize the psychological principle that attackers often use to create a sense of urgency. Which principle is this?

   • AAuthority
   • BScarcity
   • CUrgency
   • DSocial proof
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is designing a security awareness training program. The goal is to reduce the success of phishing attacks that exploit authority and urgency. Which training approach is most effective for this goal?

   • AA one-time email to all employees describing common phishing techniques.
   • BSimulated phishing campaigns with immediate feedback and micro-learning modules.
   • CAnnual training that covers all security topics in a single session.
   • DPosters in the break room reminding employees to be cautious of emails.
   Reveal Solution Discussion Select an answer first