Social Engineering Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You are conducting a physical social engineering test for a client. The client has a secure area that requires a badge swipe. You need to gain access to the area without being detected. Which technique is most likely to succeed?

   • APretexting: call the security desk and claim you are a contractor who needs access to the area.
   • BDumpster diving: search through the trash for a badge that was thrown away.
   • CTailgating: follow an employee through the door after they swipe their badge.
   • DShoulder surfing: stand near the door and watch the employee enter their access code.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a phishing campaign, which component is essential for tracking whether a target clicked a link in the phishing email?

   • AA cloned login page that logs credentials
   • BA unique tracking link or web beacon embedded in the email
   • CA spoofed sender address that matches the target's domain
   • DA payload attachment that executes when opened
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are conducting a physical social engineering test for a client. The goal is to see if you can gain access to a secure area by following an employee through a door. Which technique is most appropriate?

   • APretexting: call the security desk and claim you are a contractor who needs access to the area.
   • BShoulder surfing: stand near the door and watch the employee enter their access code.
   • CDumpster diving: search through the trash near the entrance for access badges.
   • DTailgating: follow closely behind an employee as they enter the secure area.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are using the Social-Engineer Toolkit (SET) to create a phishing campaign. You want to clone a legitimate website and host it on your server to capture credentials. Which SET module should you use?

   • AFast-Track
   • BPayload Generation
   • CWebsite Attack Vectors
   • DInfectious Media Generator
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A penetration tester is performing a physical security assessment. The tester needs to obtain sensitive documents that employees have discarded. Which technique is most appropriate for this task?

   • AShoulder surfing
   • BPretexting
   • CTailgating
   • DDumpster diving
   Reveal Solution Discussion Select an answer first