Social Engineering Techniques and Countermeasures ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An employee receives a suspicious email that asks for login credentials to a company portal. The employee does not click any links and wants to report it. What is the most appropriate action?

   • AForward the email as an attachment to the security team and then delete it from the inbox.
   • BReply to the sender asking them to stop sending such emails.
   • CIgnore the email and delete it without reporting.
   • DClick the link to see where it goes, then report it.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A social engineer calls an employee, claiming to be from the IT department and stating that they need the employee's login credentials to fix a critical server issue. Which technique is being used?

   • AQuid pro quo
   • BTailgating
   • CImpersonation
   • DBaiting
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An attacker sends an email to a company's accounts payable department, posing as a vendor, and claims that the payment details have changed. The email includes a link to a fake invoice portal. Which social engineering attack vector is being used, and what psychological principle is primarily exploited?

   • APhishing; exploiting authority by impersonating a known vendor.
   • BQuid pro quo; exploiting fear of missing a payment.
   • CBaiting; exploiting curiosity with a fake invoice portal.
   • DPretexting; exploiting helpfulness by offering to update payment details.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which social engineering attack specifically targets high-level executives such as CEOs or CFOs?

   • APharming
   • BWhaling
   • CVishing
   • DSmishing
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An attacker calls an employee, claiming to be from the company's legal department, and asks for the employee's home address and date of birth for 'compliance purposes'. The employee provides the information. Which social engineering principle is being exploited, and what is the best countermeasure?

   • AAuthority; implement a policy that requires verification of unsolicited requests for personal information
   • BScarcity; enforce a clean desk policy
   • CSocial proof; conduct security awareness training
   • DUrgency; implement multi-factor authentication
   Reveal Solution Discussion Select an answer first