Social Engineering Techniques and Countermeasures ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An employee receives a suspicious phone call from someone claiming to be a vendor, asking for the company's bank account details to 'process a payment'. The employee does not recognize the vendor. What should the employee do?

   • APolitely decline to provide information and report the call to the security team.
   • BTransfer the call to the accounts payable department.
   • CProvide the information to avoid delaying the payment.
   • DAsk for the vendor's phone number and call them back later.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A caller claims to be from IT support and asks an employee to reveal their password to 'fix a network issue'. The employee complies. Which social engineering principle is being exploited, and what countermeasure would be most effective?

   • AAuthority; implement multi-factor authentication
   • BUrgency; conduct phishing simulations
   • CSocial proof; implement caller ID verification
   • DScarcity; enforce a password policy
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An attacker calls an employee, claiming to be from a vendor, and offers a free security audit in exchange for the employee's network credentials. Which attack vector is this, and what is the best countermeasure?

   • AQuid pro quo; implement a policy that requires verification of unsolicited offers
   • BBaiting; disable USB ports
   • CTailgating; implement a mantrap
   • DPretexting; enforce a clean desk policy
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An attacker calls the help desk, pretending to be a new employee who forgot their password. The attacker provides a fake employee ID and asks for a password reset. Which social engineering technique is being used, and what countermeasure would be most effective?

   • ATailgating; implement a mantrap
   • BPretexting; implement a callback verification procedure
   • CBaiting; disable USB ports
   • DPhishing; enforce multi-factor authentication
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A cybercriminal sends a mass email to thousands of employees at different companies, claiming their email accounts will be deactivated unless they click a link and enter their credentials. Which type of attack is this, and what is the most effective countermeasure?

   • APretexting; implement a clean desk policy
   • BPhishing; implement email authentication (SPF, DKIM, DMARC)
   • CWhaling; conduct executive security training
   • DSpear phishing; enforce multi-factor authentication
   Reveal Solution Discussion Select an answer first