Social Engineering Penetration Testing CPENT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration tester has completed a social engineering assessment that included phishing and vishing. The client's management is concerned about the legal implications of the test and asks the tester to ensure the report does not expose the organization to liability. Which approach should the tester take when writing the report?

   • AInclude a clear scope and authorization section, and anonymize personal data of employees who fell for the attack
   • BRecommend that the client not take any action to avoid drawing attention to the findings
   • CInclude the names of all employees who clicked the link to show the severity
   • DExclude all technical details and only provide a summary of findings
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key characteristic of a successful pretext in a social engineering attack?

   • AIt always involves impersonating a high-level executive
   • BIt relies on the target's fear of punishment to force compliance
   • CIt is believable and aligns with the target's expectations or organizational context
   • DIt is technically complex and requires deep knowledge of the target's systems
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A penetration tester is planning a social engineering campaign that targets employees via SMS messages. The campaign aims to trick users into visiting a malicious website. Which attack vector is being used?

   • ASmishing
   • BPhishing
   • CPretexting
   • DVishing
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   You are conducting a phishing campaign for a client. The client wants to test the effectiveness of their security awareness training. They want to know if employees are more likely to click on a phishing email that is personalized with their name and job title. Which approach is most appropriate?

   • ASend only the generic email and track the click rate.
   • BSend only the personalized email and track the click rate.
   • CSend two versions of the phishing email: one generic and one personalized with the employee's name and job title, and compare the click rates.
   • DSend the personalized email to one group and the generic email to a different group, but do not track which group clicked.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After completing a social engineering penetration test, a tester must write a report for the client. The client wants to understand the overall risk and receive actionable recommendations. Which section of the report is most critical for conveying the business impact and justifying the need for remediation?

   • ADetailed technical logs of every email sent
   • BList of all employee names who clicked the link
   • CExecutive summary with risk ratings and business impact
   • DStep-by-step instructions on how to replicate the attack
   Reveal Solution Discussion Select an answer first