A security manager is designing a social engineering defense program. The company has a high employee turnover rate and a mix of remote and office-based workers. Which approach best balances effectiveness and practicality?

Implement a strict policy that all requests for sensitive information must be made in person.

Implement a mandatory security awareness training program with periodic simulated phishing tests and a clear reporting procedure.

Conduct a one-time training session for all employees and distribute a security policy document.

Rely on technical controls such as email filters and web proxies to block social engineering attempts.

A company has a policy that requires multi-factor authentication (MFA) for all email accounts. Despite this, an attacker successfully compromised an employee's email account. The attacker used a phishing page that captured both the password and the one-time code in real time. Which additional control would most effectively prevent this type of attack?

Use phishing-resistant MFA, such as FIDO2 security keys

Block all email links and require users to type URLs manually

Increase the length of the one-time code to 8 digits

Require users to change passwords every 30 days

A penetration tester is conducting a social engineering assessment. The tester wants to gain access to a secure facility by posing as a delivery person carrying a large box. The tester asks an employee to hold the door open because their hands are full. Which social engineering principle and vector is the tester using?

Reciprocity and liking; pretexting

Trust and authority; tailgating

Commitment and consistency; vishing

An employee receives an email that appears to be from the CEO, asking the employee to urgently purchase gift cards and reply with the codes. The sender address is 'ceo@company.com', but the reply-to address is 'ceo.assistant@gmail.com'. Which phishing technique is being used, and what is the most effective immediate action for the employee?

Pharming; forward the email to IT for analysis

Vishing; call the number in the email signature

Spear phishing; reply to the email asking for confirmation

Whaling; verify the request through a known, separate communication channel

EC-CouncilSOC Essentials

Domain 2Objective 5

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 2)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 6–10

6expert · hard
A security manager is designing a social engineering defense program. The company has a high employee turnover rate and a mix of remote and office-based workers. Which approach best balances effectiveness and practicality?
Select an answer first
7expert · hard
A company has a policy that requires multi-factor authentication (MFA) for all email accounts. Despite this, an attacker successfully compromised an employee's email account. The attacker used a phishing page that captured both the password and the one-time code in real time. Which additional control would most effectively prevent this type of attack?
Select an answer first
8expert · hard
A penetration tester is conducting a social engineering assessment. The tester wants to gain access to a secure facility by posing as a delivery person carrying a large box. The tester asks an employee to hold the door open because their hands are full. Which social engineering principle and vector is the tester using?
Select an answer first
9application · medium
An employee receives an email that appears to be from the CEO, asking the employee to urgently purchase gift cards and reply with the codes. The sender address is 'ceo@company.com', but the reply-to address is 'ceo.assistant@gmail.com'. Which phishing technique is being used, and what is the most effective immediate action for the employee?
Select an answer first
10foundation · easy
An attacker leaves a USB drive labeled 'Employee Bonuses' in the parking lot, hoping an employee will plug it into a work computer. This attack vector is:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 2)

Questions 6–10

A security manager is designing a social engineering defense program. The company has a high employee turnover rate and a mix of remote and office-based workers. Which approach best balances effectiveness and practicality?

An attacker leaves a USB drive labeled 'Employee Bonuses' in the parking lot, hoping an employee will plug it into a work computer. This attack vector is:

Keep studying — Fundamentals of Cyber Threats