Social Engineering Concepts and Techniques EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A penetration tester is planning a social engineering attack against a target organization. The tester has identified that the organization uses a specific third-party vendor for IT support. Which of the following would be the most effective pretext to use in a phone call to an employee?

   • AClaiming to be a customer who is having a problem with the company's product.
   • BClaiming to be a government official conducting a security audit.
   • CClaiming to be a new employee who needs help with the onboarding process.
   • DClaiming to be from the third-party IT support vendor and needing to verify the employee's account details.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   An attacker leaves a USB drive labeled 'Confidential - Employee Bonuses' in the company parking lot. An employee finds it and plugs it into their work computer out of curiosity. The USB drive installs malware. Which social engineering technique is being used?

   • ATailgating
   • BPhishing
   • CBaiting
   • DPretexting
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the typical first phase in a social engineering attack cycle?

   • AResearching the target to gather background information
   • BExploiting the target's trust to obtain information
   • CDeveloping a relationship with the target
   • DDebriefing and documenting lessons learned
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A financial services firm has experienced a vishing attack where an attacker impersonated a client and convinced a junior employee to transfer funds to a fraudulent account. The firm is now evaluating controls to prevent recurrence. Which combination of controls would be most effective?

   • AIncrease the limit for fund transfers without manager approval.
   • BRequire two-factor authentication for all employee logins.
   • CDeploy an advanced spam filter and email encryption.
   • DImplement a call-back verification procedure for all fund transfer requests and provide targeted training on vishing techniques.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which statement best defines social engineering in the context of information security?

   • AThe process of manipulating people into performing actions or divulging confidential information
   • BThe deployment of malware to disrupt an organization's network operations
   • CThe use of technical vulnerabilities in software to gain unauthorized access to systems
   • DThe act of physically stealing hardware devices such as laptops or servers
   Reveal Solution Discussion Select an answer first