Social Engineering and Phishing CEH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   During a social engineering attack, the attacker gathers information about the target, establishes a relationship, and then exploits the relationship to obtain sensitive data. Which phase of the social engineering attack cycle does the exploitation occur in?

   • APlay
   • BResearch
   • CExit
   • DHook
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A penetration tester is planning a social engineering assessment for a client. The client has a strong security awareness program and employees are trained to spot phishing emails. The tester needs to achieve a high success rate while minimizing the risk of being detected. Which approach is most likely to succeed?

   • ACombine pretexting with a phone call to a specific employee, using information from public sources to build credibility, and then send a personalized spear-phishing email.
   • BSend a generic phishing email to all employees with a link to a fake login page.
   • CUse a vishing call to the help desk, impersonating a new employee needing a password reset.
   • DDrop USB drives in the parking lot with a label 'Confidential' to entice employees to plug them in.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial analyst receives an email that appears to be from the company's CEO, urgently requesting a wire transfer to a new vendor. The email address is ceo@company-legal.com, and the message contains a link to a document titled 'Invoice_Urgent.docm'. The analyst is about to comply. Which action should the analyst take first?

   • AReply to the email asking for more details
   • BVerify the request through a known, independent communication channel
   • CClick the link to review the invoice before proceeding
   • DForward the email to the IT helpdesk for immediate processing
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing a suspicious email reported by an employee. The email claims to be from a well-known shipping company, contains an attachment named 'invoice_2024.exe', and the sender address is 'support@shipment-tracking-now.com'. The email body has a sense of urgency and asks the employee to open the attachment to avoid a delivery delay. Which two indicators most strongly suggest a malicious phishing email?

   • AThe sender domain is not the legitimate shipping company's domain, and the attachment is an executable file.
   • BThe attachment is named 'invoice_2024.exe', and the email contains a greeting.
   • CThe email body has a sense of urgency, and the employee reported it.
   • DThe sender address is 'support@shipment-tracking-now.com', and the email was sent during business hours.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration tester is conducting a social engineering assessment. The client has a strict policy that all visitors must be escorted, and the front desk is staffed. The tester wants to gain physical access to the server room. Which approach is most likely to succeed while minimizing the risk of detection?

   • AWait in the parking lot and ask an employee to hold the door, then ask for directions to the server room.
   • BUse pretexting to call the IT manager and claim to be a vendor needing to perform urgent maintenance on the server room's cooling system.
   • CTailgate an employee through the main entrance and then follow them to the server room.
   • DUse baiting by leaving a USB drive labeled 'Server Room Access' near the entrance.
   Reveal Solution Discussion Select an answer first