A penetration tester is conducting a physical social engineering assessment. The target is a secure office building with a badge-controlled entrance. The tester needs to gain access to the server room to test physical security controls. Which combination of techniques is most likely to succeed while minimizing the risk of detection?

Tailgate behind an employee through the main entrance, then use a pretext as an IT contractor to ask an employee to hold the server room door open.

Dumpster dive for a badge in the trash, then use the badge to enter the building and the server room.

Call the front desk, impersonate a fire inspector, and request that the server room door be unlocked remotely.

Shoulder surf the access code from a distance, then enter the server room using the observed code.

You are performing a social engineering test for a client. You need to obtain the CEO's email password. You have learned that the CEO is a fan of a specific hobby. Which pretext is most likely to succeed?

Send an email to the CEO pretending to be from the IT department, asking them to verify their password for a security audit.

Create a fake website related to the CEO's hobby and send a link to the CEO, asking them to log in to access exclusive content.

Call the CEO's assistant and pretend to be a vendor, asking for the CEO's email password to send a document.

Look over the CEO's shoulder as they type their email password on their laptop.

You are setting up a phishing campaign for a client using GoPhish. The client wants to send a test email to a small group of users and track who opens the email and clicks the link. You need to ensure that the campaign is compliant with the client's privacy policy and that the data collected is handled securely. Which configuration is most important?

Use a fake domain that is similar to the client's domain to avoid detection.

Enable SSL/TLS on the GoPhish server and use a valid certificate for the landing page domain.

Send the emails from a personal email account to avoid being blocked by the client's email server.

Set the campaign to automatically delete all captured data after the test is complete.

EC-CouncilCertified Penetration Testing Professional

Domain 2Objective 2

Social Engineering Penetration Testing CPENT Practice Questions (Page 5)

Part of the Information Gathering and Social Engineering domain, which makes up ~9% of our current practice bank.

36questions here

8free pages

6concepts

Questions 21–25

21application · medium
A penetration tester is conducting a physical social engineering assessment. The target is a secure office building with a badge-controlled entrance. The tester needs to gain access to the server room to test physical security controls. Which combination of techniques is most likely to succeed while minimizing the risk of detection?
Select an answer first
22application · medium
You are performing a social engineering test for a client. You need to obtain the CEO's email password. You have learned that the CEO is a fan of a specific hobby. Which pretext is most likely to succeed?
Select an answer first
23application · medium
You are setting up a phishing campaign for a client using GoPhish. The client wants to send a test email to a small group of users and track who opens the email and clicks the link. You need to ensure that the campaign is compliant with the client's privacy policy and that the data collected is handled securely. Which configuration is most important?
Select an answer first
24foundation · easy
Which physical social engineering technique involves looking over a person's shoulder to capture sensitive information such as passwords or PINs?
Select an answer first
25application · medium
A penetration tester is using SET to create a phishing email. The tester wants to attach a malicious PDF that will execute a payload when opened. Which SET menu option should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Social Engineering Penetration Testing CPENT Practice Questions (Page 5)

Questions 21–25

You are performing a social engineering test for a client. You need to obtain the CEO's email password. You have learned that the CEO is a fan of a specific hobby. Which pretext is most likely to succeed?

Which physical social engineering technique involves looking over a person's shoulder to capture sensitive information such as passwords or PINs?

A penetration tester is using SET to create a phishing email. The tester wants to attach a malicious PDF that will execute a payload when opened. Which SET menu option should the tester use?

Keep studying — Information Gathering and Social Engineering