Social Engineering Concepts and Techniques EHE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common financial impact of social engineering attacks on individuals?

   • AFree identity protection services from the attacker
   • BIncreased credit score due to identity verification
   • CGuaranteed refunds from financial institutions
   • DUnauthorized credit card charges or bank transfers
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which sequence correctly represents the typical phases of a social engineering attack?

   • AResearch → Exploit trust → Develop relationship → Exit
   • BExploit trust → Research → Develop relationship → Exit
   • CDevelop relationship → Research → Exploit trust → Exit
   • DResearch → Develop relationship → Exploit trust → Debrief
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst receives a call from someone claiming to be a senior vice president who urgently needs the analyst's personal email address to 'share a confidential document.' The caller's voice sounds familiar, and the analyst recognizes the name from the company directory. What should the analyst do first?

   • AVerify the caller's identity through a known corporate channel, such as calling the number in the official directory, before sharing any information.
   • BProvide the email address because the caller is a senior executive and the request is urgent.
   • CHang up immediately and report the call to the security team as a potential social engineering attempt.
   • DAsk the caller to send the document to the analyst's work email instead, since that is more secure.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which social engineering technique involves an attacker physically following an authorized employee through a secured door without proper credentials?

   • ABaiting
   • BPretexting
   • CTailgating
   • DPhishing
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is planning a social engineering assessment. They have limited time and budget. The goal is to test both technical and human defenses. They have already conducted a phishing simulation and found that 20% of employees clicked a link. The team now wants to test physical security. Which approach would be most effective and efficient?

   • AHire an external firm to conduct a full red team exercise.
   • BDeploy a second phishing campaign with a more sophisticated lure, such as a fake HR portal.
   • CConduct a baiting test by leaving USB drives in the parking lot and monitoring if they are plugged in.
   • DConduct a tailgating test at the main entrance during peak hours, followed by a pretexting call to the help desk to obtain a password reset.
   Reveal Solution Discussion Select an answer first