Social Engineering Techniques and Countermeasures ECSS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst discovers that a senior executive's email account has been compromised. The attacker used a spear-phishing email that appeared to be from a board member, requesting confidential financial reports. The executive's email client did not flag the email as external. Which combination of countermeasures would best prevent this from recurring?

   • AEnable external email tagging and implement a policy requiring out-of-band verification for sensitive requests.
   • BRequire executives to change passwords every 30 days and use a password manager.
   • CIncrease spam filter sensitivity and block all emails from external domains.
   • DConduct a one-time security awareness training for executives.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which human psychological characteristic is most commonly exploited by social engineers when they pretend to be a technical support agent who needs a user's password to fix an urgent problem?

   • AGreed and desire for reward
   • BFear and urgency
   • CCuriosity and interest
   • DObligation and reciprocity
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What should an employee do immediately after suspecting they have been a target of a social engineering attack?

   • AReport the incident to the security team or designated point of contact
   • BConfront the attacker directly
   • CShare the details on social media to warn others
   • DDelete all emails and ignore the incident
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of regular security awareness training in mitigating social engineering risks?

   • ATo ensure employees use strong passwords
   • BTo teach employees to recognize and respond appropriately to social engineering attempts
   • CTo provide employees with a list of all known attackers
   • DTo replace technical security controls
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common characteristic of a pretexting attack?

   • AThe attacker sends a mass email to many recipients
   • BThe attacker uses malware to steal data
   • CThe attacker creates a believable false scenario to establish trust
   • DThe attacker physically follows an employee into a secure area
   Reveal Solution Discussion Select an answer first