A company is evaluating the potential impact of a social engineering attack. They are considering two scenarios: (1) a successful phishing attack that steals employee credentials, and (2) a successful pretexting attack that convinces an employee to transfer funds to a fraudulent account. Which scenario is likely to have a greater financial impact?

The phishing attack, because it can lead to a data breach

The pretexting attack, because it directly results in a financial loss

Both have equal financial impact because they are both social engineering attacks

The phishing attack, because it can affect all employees

A company experiences a social engineering attack where an attacker impersonates an IT technician and convinces an employee to reveal their password. The attacker then accesses the employee's email and forwards confidential client contracts to an external account. Which of the following is the most significant potential impact of this attack?

Loss of the employee's personal reputation only

Temporary unavailability of the email server

Loss of client confidentiality and potential legal liability

Increased spam emails in the employee's inbox

A security consultant is advising a client on how to reduce the effectiveness of social engineering attacks that exploit authority. Which control is most effective?

Increase the frequency of security awareness training

Enforce a strong password policy

Use email filtering to block emails from external domains that impersonate executives

Implement a verification process for unusual requests, such as a second approval for wire transfers

EC-CouncilEthical Hacking Essentials

Domain 4Objective 1

Social Engineering Concepts and Techniques EHE Practice Questions (Page 3)

Part of the Social Engineering domain, which makes up ~9% of our current practice bank.

44questions here

9free pages

5concepts

Questions 11–15

11expert · hard
A company is evaluating the potential impact of a social engineering attack. They are considering two scenarios: (1) a successful phishing attack that steals employee credentials, and (2) a successful pretexting attack that convinces an employee to transfer funds to a fraudulent account. Which scenario is likely to have a greater financial impact?
Select an answer first
12application · medium
A company experiences a social engineering attack where an attacker impersonates an IT technician and convinces an employee to reveal their password. The attacker then accesses the employee's email and forwards confidential client contracts to an external account. Which of the following is the most significant potential impact of this attack?
Select an answer first
13expert · hard
A security consultant is advising a client on how to reduce the effectiveness of social engineering attacks that exploit authority. Which control is most effective?
Select an answer first
14application · medium
A penetration tester is hired to assess an organization's susceptibility to social engineering. The tester plans to send an email to employees that appears to come from the IT help desk, stating that their mailbox is over quota and they must click a link to 'verify' their account within 24 hours. The email includes the company logo and the help desk manager's signature. Which combination of social engineering principles is the tester primarily exploiting?
Select an answer first
15foundation · easy
An attacker sends an email that appears to be from a trusted bank, asking the recipient to click a link and verify their account details. Which social engineering technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Social Engineering Concepts and Techniques EHE Practice Questions (Page 3)

Questions 11–15

A security consultant is advising a client on how to reduce the effectiveness of social engineering attacks that exploit authority. Which control is most effective?

An attacker sends an email that appears to be from a trusted bank, asking the recipient to click a link and verify their account details. Which social engineering technique is being used?

Keep studying — Social Engineering