Social Engineering Penetration Testing CPENT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a penetration test report, which section should include the social engineering techniques used, the number of users who fell victim, and the specific information or access obtained?

   • AFindings
   • BRecommendations
   • CMethodology
   • DExecutive summary
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A penetration tester calls a company's help desk, claims to be a new employee who forgot their password, and provides a fake employee ID to reset the password. Which social engineering technique is being used?

   • ATailgating
   • BShoulder surfing
   • CPretexting
   • DPhishing
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   The Social-Engineer Toolkit (SET) is a framework that includes multiple attack vectors. Which of the following is a feature of SET?

   • AIt is primarily used for network vulnerability scanning
   • BIt can only be used for physical social engineering attacks
   • CIt requires a commercial license to use
   • DIt provides a menu-driven interface to launch attacks such as spear-phishing, website cloning, and infectious media
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A penetration tester is using GoPhish for a phishing campaign. The client wants to track not only clicks but also which users submit data on the landing page. The tester has set up the campaign but notices that the 'submitted data' report is empty even though users have clicked the link. Which configuration is most likely the cause?

   • AThe email template does not include a tracking pixel
   • BThe landing page is hosted on a different server than the GoPhish server
   • CThe campaign is set to 'send only' and not 'track clicks'
   • DThe landing page does not have a form field with a 'name' attribute
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A client wants to test their employees' awareness of smishing attacks. They want to see if employees will click on a link in a text message that appears to be from a legitimate source. Which approach is most appropriate?

   • ASend an email with a link to a fake login page and track who clicks.
   • BLeave a voicemail asking employees to call back and provide their password.
   • CSend a text message to employees with a link to a fake login page and track who clicks.
   • DCall employees and ask them to verify their account information over the phone.
   Reveal Solution Discussion Select an answer first