Social Engineering Concepts and Techniques EHE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is conducting a social engineering assessment. They have a limited budget and want to test the organization's resistance to both phishing and phone-based attacks. They have already gathered employee names and job roles from LinkedIn. Which of the following plans would be the most efficient and effective?

   • ASend a mass phishing email to all employees and then conduct a tailgating test.
   • BSend a spear phishing email to a few high-risk employees and follow up with a vishing call to those who did not click.
   • CConduct only a vishing campaign against the help desk.
   • DPurchase a commercial phishing simulation platform and run a campaign.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A user receives a phone call from someone claiming to be a Microsoft support technician who says the user's computer is sending malware and needs immediate remote access to fix it. The caller is insistent and uses technical jargon. What psychological principle is the attacker primarily relying on?

   • ASocial proof, because other users have had similar issues.
   • BAuthority, because the caller claims to be from Microsoft.
   • CScarcity, because the malware is spreading.
   • DReciprocity, because the caller is offering help.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team is analyzing a social engineering attack. The attacker first created a fake LinkedIn profile of a recruiter and connected with employees. Then the attacker sent a message with a link to a fake job application page that captured credentials. Which phases of the social engineering attack cycle are demonstrated?

   • APreparation and impact only
   • BReconnaissance and baiting only
   • CDelivery and exploitation only
   • DResearch and development of a pretext, then execution via phishing
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A small business owner receives a call from someone claiming to be from the local utility company, stating that their electricity will be shut off unless they pay an overdue bill immediately via a prepaid card. The owner is worried and considers paying. What is the most likely impact if the owner complies?

   • AThe owner will receive a refund from the utility company.
   • BThe owner's credit score will be affected.
   • CThe utility company will send a technician to fix the issue.
   • DThe owner will lose the money paid via the prepaid card, and the business may suffer a financial loss.
   Reveal Solution Discussion Select an answer first
6. 35application · easy

   An attacker sends an email to a company's employees, claiming that their email accounts will be deactivated unless they confirm their password within 24 hours. The email includes a link to a fake login page. Which psychological principle is the attacker primarily exploiting?

   • AReciprocity, because the email is offering a service.
   • BGreed, because the employees might gain something.
   • CFear, because the employees fear losing access to their email.
   • DSocial proof, because other employees are doing it.
   Reveal Solution Discussion Select an answer first