A penetration tester is planning a phishing campaign against a client's finance department. The client requires that the campaign use a realistic pretext, track which users click the link, and provide a report that includes metrics for management. The tester has access to GoPhish and the client's approved email gateway. Which approach best meets the client's requirements?

Use the Social-Engineer Toolkit's email attack vector with a pre-made template and a hosted phishing page, then manually review the web server access logs for the report.

Use a custom Python script to send emails with a malicious attachment and rely on the email gateway's logs to determine who opened the attachment.

Use GoPhish to send emails with a fake invoice pretext, host a landing page that records clicks and credentials, and export the campaign statistics for the report.

Use SET to clone the company's internal portal and send emails manually from a personal Gmail account, then compile statistics from the server logs.

You are performing a physical social engineering test for a client. The goal is to obtain sensitive documents from a shredding bin outside the building. Which technique is most appropriate and least likely to be noticed?

Dumpster diving: search through the shredding bin for documents that were not properly shredded.

Pretexting: call the facility manager and claim you need to collect the bin for recycling.

Shoulder surfing: stand near the bin and watch as employees dispose of documents.

Tailgating: follow an employee into the building and then access the bin from inside.

When setting up a landing page for a phishing campaign, what is the primary purpose of hosting the page on a domain that closely resembles the target organization's legitimate domain?

To bypass email security filters that block known malicious domains

To comply with legal requirements for penetration testing

To make the phishing page appear legitimate and increase the likelihood that targets will enter their credentials

To ensure the phishing page is indexed by search engines for future attacks

EC-CouncilCertified Penetration Testing Professional

Domain 2Objective 2

Social Engineering Penetration Testing CPENT Practice Questions (Page 1)

Part of the Information Gathering and Social Engineering domain, which makes up ~9% of our current practice bank.

36questions here

8free pages

6concepts

Questions 1–5

1application · medium
A penetration tester is planning a phishing campaign against a client's finance department. The client requires that the campaign use a realistic pretext, track which users click the link, and provide a report that includes metrics for management. The tester has access to GoPhish and the client's approved email gateway. Which approach best meets the client's requirements?
Select an answer first
2foundation · easy
A penetration tester waits for an employee to badge into a secured office and then follows closely behind without using a badge. Which physical social engineering technique is being used?
Select an answer first
3application · medium
You are performing a physical social engineering test for a client. The goal is to obtain sensitive documents from a shredding bin outside the building. Which technique is most appropriate and least likely to be noticed?
Select an answer first
4foundation · easy
Which open-source tool is specifically designed to automate the creation and management of phishing campaigns, including email templates, landing pages, and tracking?
Select an answer first
5foundation · easy
When setting up a landing page for a phishing campaign, what is the primary purpose of hosting the page on a domain that closely resembles the target organization's legitimate domain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Social Engineering Penetration Testing CPENT Practice Questions (Page 1)

Questions 1–5

A penetration tester waits for an employee to badge into a secured office and then follows closely behind without using a badge. Which physical social engineering technique is being used?

You are performing a physical social engineering test for a client. The goal is to obtain sensitive documents from a shredding bin outside the building. Which technique is most appropriate and least likely to be noticed?

Which open-source tool is specifically designed to automate the creation and management of phishing campaigns, including email templates, landing pages, and tracking?

When setting up a landing page for a phishing campaign, what is the primary purpose of hosting the page on a domain that closely resembles the target organization's legitimate domain?

Keep studying — Information Gathering and Social Engineering