Social Engineering and Phishing CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has experienced several successful phishing attacks where employees clicked on malicious links in emails. The security team wants to implement a technical control that will block malicious links at the point of click, even if the email passes through the gateway. Which solution best meets this requirement?

   • AConduct quarterly security awareness training for all employees.
   • BDeploy a web proxy with URL filtering and real-time threat intelligence.
   • CImplement DMARC, DKIM, and SPF email authentication.
   • DDisable hyperlinks in all incoming emails at the email gateway.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company wants to implement a security awareness program that addresses both phishing and physical social engineering (tailgating). Which combination of measures is most effective?

   • AAnnual training on phishing and a policy requiring employees to wear badges.
   • BQuarterly simulated phishing campaigns and a 'no tailgating' policy with spot checks.
   • CA one-time security briefing and a mantraps at the entrance.
   • DPosters reminding employees to be cautious and a visitor sign-in sheet.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which social engineering vector involves an attacker physically following an authorized employee through a secured door without using their own credentials?

   • ATailgating
   • BPretexting
   • CQuid pro quo
   • DBaiting
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An attacker leaves a USB drive in the parking lot of a company. The drive is labeled 'Confidential - Employee Bonuses'. An employee finds the drive and plugs it into their work computer out of curiosity. Which social engineering vector is being used?

   • ABaiting
   • BTailgating
   • CPretexting
   • DQuid pro quo
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a typical indicator of a phishing email?

   • AThe email is sent during normal business hours
   • BThe email includes the recipient's correct job title
   • CThe email is sent from a domain that matches the company's official domain exactly
   • DThe email contains a sense of urgency and requests immediate action
   Reveal Solution Discussion Select an answer first