Social Engineering Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   During a penetration test, an assessor sends a fraudulent email that appears to come from the target organization's IT help desk, asking the recipient to verify their account credentials by clicking a link. Which social engineering attack vector is being used?

   • APretexting
   • BSmishing
   • CPhishing
   • DVishing
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is setting up a phishing campaign for a client. The client requires that the campaign be realistic but also that the tester capture credentials from users who fall for it. The tester plans to use GoPhish. What is the most effective way to capture credentials while maintaining realism?

   • AUse a URL shortener to hide the phishing link and redirect to the company's real website
   • BSend an email with a malicious attachment that installs a keylogger
   • CHost a landing page that mimics the company's login portal and record submitted credentials
   • DSend an email that asks users to reply with their passwords
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You are using GoPhish to run a phishing campaign for a client. You need to send a test email to a small group of users and track who opens the email and clicks the link. Which feature should you use?

   • AEmail Templates
   • BLanding Pages
   • CUsers & Groups
   • DCampaigns
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a social engineering test, you need to obtain the Wi-Fi password from an employee. You have learned that the employee is a fan of a local sports team. Which pretext is most likely to succeed?

   • ACall the employee and pretend to be from the IT department, asking them to verify their Wi-Fi password for a security audit.
   • BApproach the employee in person and start a conversation about the sports team, then casually ask if they know the Wi-Fi password because you need to check your email.
   • CLook over the employee's shoulder as they type the Wi-Fi password on their laptop.
   • DSend an email with a link to a fake Wi-Fi login page and ask the employee to enter their password to verify their account.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A client wants to test their employees' susceptibility to vishing attacks. They want to see if employees will reveal their passwords over the phone. Which approach is most effective and ethical?

   • AUse a pretext that requires the employee to visit a website and enter their credentials, rather than asking for the password over the phone.
   • BLeave a voicemail asking employees to call back and provide their password for a security update.
   • CSend an email asking employees to call a number and enter their password to verify their account.
   • DCall employees and pretend to be from the IT helpdesk, asking them to verify their password for a security audit.
   Reveal Solution Discussion Select an answer first