Social Engineering Countermeasures EHE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company's finance department receives a phone call from someone claiming to be the CEO's executive assistant, urgently requesting a wire transfer to a new vendor. The caller knows the CEO's name and travel schedule. The finance manager is not familiar with this vendor. Which action best aligns with social engineering countermeasures?

   • AReport the call to the IT helpdesk and ignore the request
   • BAsk the caller to send an email from the CEO's official email address
   • CProcess the transfer because the caller knows internal details
   • DVerify the request through a known, independently confirmed contact method before processing
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company's security team wants to reduce the likelihood that employees will fall for pretexting phone calls. They have a limited budget and must choose one new initiative. Which initiative is most likely to be effective?

   • AProvide role-based training that includes realistic pretexting scenarios and teaches employees how to respond.
   • BDistribute a one-page flyer about common social engineering tactics.
   • CPurchase a new phone system that displays caller ID for all incoming calls.
   • DRequire all employees to change their passwords every 30 days.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company has been hit by several phishing emails that bypassed the email gateway and reached users. The emails contained links to credential-harvesting sites. The security team wants to add a technical control that directly reduces the risk of users submitting credentials on these sites. Which control is most effective?

   • AAdd a warning banner to emails from external senders.
   • BBlock all emails containing links.
   • CIncrease the frequency of spam filter updates.
   • DDeploy multi-factor authentication (MFA) for all user accounts.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An employee receives an urgent email from a colleague asking for a list of customer email addresses to 'complete a time-sensitive project'. The employee has never worked with this colleague before. What should the employee do?

   • AReply to the email asking for more details
   • BSend the information because the email is from an internal address
   • CIgnore the email and do nothing
   • DVerify the request by calling the colleague using the phone number in the corporate directory
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company is updating its security policies to reduce the risk of social engineering. Which policy is most directly effective in preventing an attacker from using a fake urgent request to obtain sensitive information?

   • ARequire all requests for information to be submitted in writing via email.
   • BEncourage employees to be friendly and helpful to all callers.
   • CRequire employees to verify any unusual request for sensitive information through a known, independent channel before complying.
   • DAllow employees to use their judgment when handling urgent requests.
   Reveal Solution Discussion Select an answer first