Social Engineering Concepts and Techniques EHE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is tasked with assessing an organization's susceptibility to social engineering. The tester has already gathered employee names, job roles, and the names of internal projects from LinkedIn and the company website. What is the most logical next step in the social engineering attack cycle?

   • AReport the findings to management and recommend security awareness training.
   • BLaunch a phishing campaign immediately using the gathered names to increase credibility.
   • CDevelop a pretext and select a communication channel, such as a phone call or email, that aligns with the gathered information.
   • DAttempt to tailgate into the building to gain physical access.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An employee at a financial firm receives a phone call from someone claiming to be a senior auditor who needs immediate access to a client's account details to 'resolve a compliance issue.' The caller already knows the client's name and the employee's manager. The employee provides the information. Which social engineering technique is most directly demonstrated?

   • ABaiting
   • BPretexting
   • CPhishing
   • DTailgating
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is designing a phishing simulation. They want to test employees' resistance to authority-based attacks. The team has two options: (1) send an email from a fake CEO asking for urgent wire transfer, or (2) send an email from a fake IT help desk asking for password verification. The team has limited time and wants the highest click rate. Which option is likely to be more effective, and why?

   • AOption 2, because help desk requests are more common and less suspicious
   • BOption 2, because employees are more likely to trust IT than executives
   • CBoth are equally effective because they both use urgency
   • DOption 1, because authority is a stronger psychological trigger than urgency
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An organization wants to reduce the risk of tailgating at its main entrance. Which control is most directly effective against this technique?

   • ADeploy an intrusion detection system on the network
   • BImplement a robust password policy
   • CProvide security awareness training on phishing emails
   • DInstall a mantraps and enforce a one-person-per-entry policy
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An employee receives a text message from an unknown number claiming to be the company's HR department, stating that the employee has won a $500 gift card and must click a link to claim it. The link leads to a fake login page. Which psychological principle is being exploited?

   • AFear, because the employee might miss out on the gift card.
   • BAuthority, because the message appears to be from HR.
   • CGreed, because the employee is enticed by the gift card.
   • DUrgency, because the employee must claim the gift card quickly.
   Reveal Solution Discussion Select an answer first