Social Engineering Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   A penetration tester calls a target employee, pretends to be from the company's IT department, and asks for the employee's password to 'fix a network issue.' Which social engineering attack vector is being used?

   • AVishing
   • BPhishing
   • CSmishing
   • DTailgating
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A penetration tester is conducting a vishing attack and needs to obtain a user's password. The tester calls the user, pretending to be from the IT help desk, and claims there is a security issue that requires the user to verify their password. Which social engineering principle is the tester primarily exploiting?

   • ASocial proof
   • BScarcity
   • CReciprocity
   • DAuthority
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an effective mitigation strategy to reduce the risk of social engineering attacks in an organization?

   • AImplementing a robust password policy that requires complex passwords
   • BUsing encryption for all data at rest
   • CConducting regular security awareness training for employees
   • DDeploying a firewall to block malicious traffic
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is executing a phishing campaign and needs to ensure that the campaign does not trigger the client's email security filters. The tester has access to the client's email gateway. Which action is most effective in avoiding detection by email filters?

   • AEmbed the phishing link in an image to avoid text-based filters
   • BUse a very short URL that redirects to the phishing page
   • CUse a domain that is similar to the client's domain and configure SPF and DKIM records
   • DSend emails from a free email service like Gmail
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You are conducting a physical social engineering test for a client. The goal is to see if you can obtain sensitive information from employees by observing them as they enter their access codes on a keypad. Which technique is most appropriate?

   • ATailgating: follow an employee through the door after they enter their code.
   • BShoulder surfing: stand near the keypad and watch as employees enter their codes.
   • CPretexting: call the security desk and claim you are a contractor who needs the access code.
   • DDumpster diving: search through the trash for written access codes.
   Reveal Solution Discussion Select an answer first