A company wants to reduce the risk of pretexting attacks, where attackers impersonate IT staff to obtain credentials. They have a helpdesk that sometimes needs to verify user identities over the phone. Which policy would best balance security and operational efficiency?

Rely on caller ID to verify the user's identity.

Prohibit all phone-based support and require users to visit the helpdesk in person.

Require helpdesk staff to verify identity using a one-time passcode sent to the user's registered mobile device before discussing account details.

Allow helpdesk staff to ask for the user's password as a form of verification.

A company has experienced several social engineering incidents where employees were tricked into revealing passwords over the phone. Which combination of measures would most effectively reduce this risk?

Disable caller ID on all company phones to prevent spoofing.

Require employees to change passwords weekly and use complex passwords.

Install a voice biometric system that verifies employees by their voice.

Implement a policy that IT will never ask for passwords, and train employees to verify callers through a known callback number.

A user reports that after visiting a legitimate news website, their browser redirected to an unknown page and then a file was downloaded automatically. The user did not click any links. The file, when executed, began encrypting files on the workstation. Which malware delivery mechanism and malware type best describe this incident?

Malicious attachment delivering a worm

Phishing link delivering a Trojan

Drive-by download delivering ransomware

How does multi-factor authentication (MFA) help protect against phishing attacks?

It encrypts all email communications

It requires an additional verification factor, so a stolen password alone is not enough

It automatically detects and quarantines malicious links in emails

It blocks all phishing emails before they reach the user

EC-CouncilSOC Essentials

Domain 2Objective 5

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 4)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 16–20

16expert · hard
A company wants to reduce the risk of pretexting attacks, where attackers impersonate IT staff to obtain credentials. They have a helpdesk that sometimes needs to verify user identities over the phone. Which policy would best balance security and operational efficiency?
Select an answer first
17application · medium
A company has experienced several social engineering incidents where employees were tricked into revealing passwords over the phone. Which combination of measures would most effectively reduce this risk?
Select an answer first
18application · medium
A user reports that after visiting a legitimate news website, their browser redirected to an unknown page and then a file was downloaded automatically. The user did not click any links. The file, when executed, began encrypting files on the workstation. Which malware delivery mechanism and malware type best describe this incident?
Select an answer first
19foundation · easy
How does multi-factor authentication (MFA) help protect against phishing attacks?
Select an answer first
20foundation · easy
An attacker creates a fake scenario, such as claiming to be a contractor who needs to check the wiring, to gain physical access to a building. This social engineering vector is called:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 4)

Questions 16–20

A company wants to reduce the risk of pretexting attacks, where attackers impersonate IT staff to obtain credentials. They have a helpdesk that sometimes needs to verify user identities over the phone. Which policy would best balance security and operational efficiency?

A company has experienced several social engineering incidents where employees were tricked into revealing passwords over the phone. Which combination of measures would most effectively reduce this risk?

How does multi-factor authentication (MFA) help protect against phishing attacks?

An attacker creates a fake scenario, such as claiming to be a contractor who needs to check the wiring, to gain physical access to a building. This social engineering vector is called:

Keep studying — Fundamentals of Cyber Threats