A company is designing a security awareness program. The budget is limited, and the security team must choose between two options: (1) quarterly simulated phishing campaigns with immediate feedback, or (2) a one-time comprehensive training session covering all social engineering vectors. The company's main risk is employees falling for phishing emails. Which option is more effective for reducing phishing susceptibility, and why?

Option 2, because it covers all vectors in a single session.

Option 2, because it is more comprehensive and covers physical social engineering.

Both are equally effective if the training is mandatory.

Option 1, because it provides ongoing reinforcement and realistic practice.

A company's CFO receives a phone call from someone claiming to be an IT support technician. The caller says there is a critical security issue and asks the CFO to provide their password to 'verify' the account. The CFO is busy and considers complying. What should the CFO do?

Provide the password to resolve the issue quickly

Ask the caller for their employee ID and then provide the password

Tell the caller to send an email request instead

Hang up and call the IT helpdesk using the official number

A company has implemented email filtering, MFA, and security awareness training. However, a recent vishing attack successfully tricked an employee into revealing their password. The attacker then used the password to access the employee's email account. Which additional control would be most effective in preventing this type of attack?

Implementing a stricter password policy with longer passwords

Implementing a web filter to block known phishing sites

Implementing a policy that requires employees to verify any phone call requesting sensitive information

Implementing a SIEM to monitor for unusual login activity

An employee at a secure facility is approached by a person wearing a delivery uniform who claims to have a package for the employee's manager. The delivery person asks the employee to hold the door open because both hands are full. The employee does not recognize the person. What is the most appropriate action for the employee to take?

Ask for identification and verify the delivery with the manager

Hold the door open to help the delivery person

Direct the delivery person to the loading dock

Ignore the person and continue walking

EC-CouncilCertified Ethical Hacker

Domain 4Objective 2

Social Engineering and Phishing CEH Practice Questions (Page 4)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 16–20

16foundation · easy
A phishing attack is specifically targeted at the CEO of a company to trick them into transferring funds. Which type of phishing attack is this?
Select an answer first
17expert · hard
A company is designing a security awareness program. The budget is limited, and the security team must choose between two options: (1) quarterly simulated phishing campaigns with immediate feedback, or (2) a one-time comprehensive training session covering all social engineering vectors. The company's main risk is employees falling for phishing emails. Which option is more effective for reducing phishing susceptibility, and why?
Select an answer first
18application · medium
A company's CFO receives a phone call from someone claiming to be an IT support technician. The caller says there is a critical security issue and asks the CFO to provide their password to 'verify' the account. The CFO is busy and considers complying. What should the CFO do?
Select an answer first
19expert · hard
A company has implemented email filtering, MFA, and security awareness training. However, a recent vishing attack successfully tricked an employee into revealing their password. The attacker then used the password to access the employee's email account. Which additional control would be most effective in preventing this type of attack?
Select an answer first
20application · medium
An employee at a secure facility is approached by a person wearing a delivery uniform who claims to have a package for the employee's manager. The delivery person asks the employee to hold the door open because both hands are full. The employee does not recognize the person. What is the most appropriate action for the employee to take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Social Engineering and Phishing CEH Practice Questions (Page 4)

Questions 16–20

A phishing attack is specifically targeted at the CEO of a company to trick them into transferring funds. Which type of phishing attack is this?

A company's CFO receives a phone call from someone claiming to be an IT support technician. The caller says there is a critical security issue and asks the CFO to provide their password to 'verify' the account. The CFO is busy and considers complying. What should the CFO do?

Keep studying — Network and Perimeter Hacking