A company has a policy that requires all visitors to be escorted. However, an attacker successfully entered the building by following an employee through a secure door without being challenged. Which social engineering vector was used, and what control would most effectively prevent this?

Tailgating; install a mantraps at the entrance

Vishing; implement a visitor management system

Baiting; install security cameras

Pretexting; require visitors to sign in

A company's endpoint protection software detects a malware infection on a user's machine. The user claims they only visited a well-known news website. The malware is a Trojan that appears to have been delivered via an exploit kit. Which action should the security team take FIRST to prevent further spread?

Isolate the infected machine from the network immediately.

Block the news website at the firewall to prevent other users from visiting it.

Run a full antivirus scan on the machine to identify all malicious files.

Notify all employees to avoid the news website.

EC-CouncilSOC Essentials

Domain 2Objective 5

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 3)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 11–15

11foundation · easy
A user visits a compromised website and malware is installed on their system without any interaction beyond loading the page. This delivery method is known as:
Select an answer first
12expert · hard
A company has a policy that requires all visitors to be escorted. However, an attacker successfully entered the building by following an employee through a secure door without being challenged. Which social engineering vector was used, and what control would most effectively prevent this?
Select an answer first
13foundation · easy
A social engineer calls an employee and claims to be a senior manager who needs immediate access to a system. Which psychological principle is being exploited?
Select an answer first
14application · medium
An attacker leaves USB drives in a company parking lot, labeled 'Confidential - Employee Bonuses'. An employee picks one up and plugs it into their work computer, which then installs malware. Which social engineering attack vector is this?
Select an answer first
15expert · hard
A company's endpoint protection software detects a malware infection on a user's machine. The user claims they only visited a well-known news website. The malware is a Trojan that appears to have been delivered via an exploit kit. Which action should the security team take FIRST to prevent further spread?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 3)

Questions 11–15

A user visits a compromised website and malware is installed on their system without any interaction beyond loading the page. This delivery method is known as:

A company has a policy that requires all visitors to be escorted. However, an attacker successfully entered the building by following an employee through a secure door without being challenged. Which social engineering vector was used, and what control would most effectively prevent this?

A social engineer calls an employee and claims to be a senior manager who needs immediate access to a system. Which psychological principle is being exploited?

An attacker leaves USB drives in a company parking lot, labeled 'Confidential - Employee Bonuses'. An employee picks one up and plugs it into their work computer, which then installs malware. Which social engineering attack vector is this?

Keep studying — Fundamentals of Cyber Threats