Social Engineering Techniques and Countermeasures ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company wants to reduce the risk of spear phishing attacks against executives. Which combination of countermeasures would be most effective?

   • AEmail filtering and security awareness training
   • BImplement a mantrap and visitor sign-in
   • CDisable USB ports and enforce clean desk policy
   • DConduct background checks and enforce non-disclosure agreements
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has experienced several successful phishing attacks. Management wants to reduce the likelihood of employees falling for these attacks. Which approach is most effective?

   • AIncrease the password complexity requirement
   • BInstall more firewalls
   • CDisable all external email
   • DConduct regular security awareness training and phishing simulations
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An attacker offers to install free security software on an employee's computer in exchange for the employee's login credentials. Which social engineering attack is this, and what is the best countermeasure?

   • AQuid pro quo; train employees to never exchange credentials for services.
   • BPhishing; enable pop-up blockers on all workstations.
   • CPretexting; require employees to verify the identity of any IT personnel.
   • DBaiting; implement a policy that only IT can install software.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user receives an email that appears to be from the company's HR department, stating that the user's benefits will be terminated unless they click a link and verify their information. The email is personalized with the user's name and job title. Which human weakness is being exploited, and what countermeasure is most effective?

   • ACuriosity; block all emails from the HR department.
   • BHelpfulness; require users to forward suspicious emails to IT.
   • CTrust in authority; implement a policy that all HR emails must be digitally signed.
   • DFear of loss; provide training on recognizing urgency and verifying requests through official channels.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to improve its defense against social engineering attacks. The security team proposes a one-time, mandatory training session for all employees. Which approach would be more effective, and why?

   • ARely on technical controls such as email filters and antivirus software.
   • BConduct regular, ongoing security awareness training with simulated phishing exercises.
   • CProvide a detailed handbook and require employees to read it once.
   • DPost posters in common areas reminding employees to be cautious.
   Reveal Solution Discussion Select an answer first