Social Engineering Techniques and Countermeasures ECSS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company wants to implement a security awareness training program to reduce the risk of social engineering attacks. Which approach is most effective?

   • AConduct regular training sessions that include real-world examples and phishing simulations
   • BConduct a one-time training session during onboarding
   • CImplement technical controls only, such as email filtering and MFA
   • DProvide a written policy document and require employees to sign it
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   Your organization has experienced several phishing attempts that bypassed the email gateway. Management wants to reduce the risk of credential theft. Which combination of countermeasures is most effective?

   • AIncrease spam filter sensitivity to the highest level.
   • BRequire users to change passwords every 30 days.
   • CImplement multi-factor authentication (MFA) and conduct regular security awareness training.
   • DDisable all email links and attachments at the gateway.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of social engineering in the context of information security?

   • ATo install malware through physical media
   • BTo use brute force to gain unauthorized access to systems
   • CTo exploit technical vulnerabilities in software
   • DTo manipulate people into divulging confidential information or performing actions that compromise security
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it important for employees to report suspected social engineering attempts to the security team?

   • ATo help the organization identify and respond to attacks, and to warn others of the threat
   • BTo satisfy legal requirements
   • CTo allow the security team to punish the attacker
   • DTo ensure the employee is not blamed for the incident
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial analyst at your company receives an email that appears to be from the CEO, urgently requesting a wire transfer to a new vendor. The email includes the CEO's full name and title, and the sender address is a lookalike domain (e.g., ceo@company-finance.com). Which type of social engineering attack is this, and what is the most effective immediate countermeasure?

   • ASpear phishing; implement a policy requiring out-of-band verification for financial transactions.
   • BPhishing; enable spam filtering to catch all such emails.
   • CWhaling; block the sender's email address in the mail gateway.
   • DPretexting; conduct a security awareness training session on email hygiene.
   Reveal Solution Discussion Select an answer first