Social Engineering and Phishing CEH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to improve its security awareness training program. Employees frequently fall for pretexting and baiting attacks. Which training approach would be most effective in addressing these specific attack vectors?

   • AProvide a one-time annual training video on general security topics
   • BRequire employees to read the company security policy and sign an acknowledgment
   • CPost posters in the break room that list common attack types
   • DConduct regular simulated pretexting and baiting exercises with immediate feedback
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is investigating a phishing email that bypassed the email gateway. The email contains a link that uses a URL shortener. The analyst wants to determine the final destination of the link without exposing the company network to risk. Which approach is the safest and most effective?

   • ABlock the URL shortener domain at the firewall
   • BClick the link directly from the analyst's workstation to see where it goes
   • CUse an online URL expander service to reveal the full URL
   • DUse a sandboxed environment with a proxy to expand the URL and access the destination
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When analyzing a suspicious email, which of the following is a common indicator of a phishing attempt?

   • AThe email is addressed to the recipient by their full name
   • BThe sender's email address closely resembles a legitimate domain but with a slight misspelling
   • CThe email contains a digital signature from a known certificate authority
   • DThe email contains a link to a website that uses HTTPS
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which technical control is most effective at preventing phishing emails from reaching users' inboxes?

   • AEmail filtering and spam detection
   • BUser awareness training
   • CPhysical access controls
   • DStrong password policy
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is developing a security awareness training program. The training must address both phishing and physical social engineering (tailgating). The company has a limited budget and cannot afford both simulated phishing campaigns and physical security drills. Which single approach is most effective for addressing both types of attacks?

   • AConduct physical security drills only, and include a module on phishing in the training.
   • BConduct simulated phishing campaigns only, and include a module on tailgating in the training.
   • CUse a combination of online training modules that cover both topics, with interactive scenarios and quizzes.
   • DPosters and email reminders about both phishing and tailgating.
   Reveal Solution Discussion Select an answer first