A person dressed as a technician enters a secured office building, claims to be from the IT department, and asks an employee to hold the door open because their badge is not working. The technician then walks in and starts unplugging network cables. Which social engineering principles and attack vector are being exploited?

Commitment and consistency; vishing

Reciprocity and liking; baiting

Authority and trust; tailgating

Urgency and scarcity; pretexting

A user receives a text message claiming to be from their bank, stating that their account has been locked and they must click a link to verify their identity. The user is unsure if the message is legitimate. Which action is the safest for the user to take?

Contact the bank using the phone number on the back of their debit card

Reply to the text message asking for more information

Forward the message to friends to ask if they received it

Click the link and enter their credentials to unlock the account

A small business wants to protect its employees from malware delivered via email attachments and drive-by downloads. They have a limited budget and no dedicated IT staff. Which approach provides the most comprehensive protection with minimal maintenance?

Use a cloud-based email filtering service and enable automatic antivirus updates on all endpoints.

Install a free antivirus on one central server and have employees scan files manually.

Train employees to identify phishing emails and rely solely on their vigilance.

Disable all email attachments and require employees to use personal email for external communications.

What is the primary purpose of security awareness training in mitigating social engineering?

To ensure employees never share any information with anyone

To teach employees how to recognize and respond to social engineering attempts

To guarantee that no social engineering attack will ever succeed

To replace technical security controls entirely

EC-CouncilSOC Essentials

Domain 2Objective 5

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 7)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 31–35

31foundation · easy
A phishing attack targets a specific senior executive by name and uses information about their role to craft a convincing email. This technique is called:
Select an answer first
32application · medium
A person dressed as a technician enters a secured office building, claims to be from the IT department, and asks an employee to hold the door open because their badge is not working. The technician then walks in and starts unplugging network cables. Which social engineering principles and attack vector are being exploited?
Select an answer first
33application · medium
A user receives a text message claiming to be from their bank, stating that their account has been locked and they must click a link to verify their identity. The user is unsure if the message is legitimate. Which action is the safest for the user to take?
Select an answer first
34application · medium
A small business wants to protect its employees from malware delivered via email attachments and drive-by downloads. They have a limited budget and no dedicated IT staff. Which approach provides the most comprehensive protection with minimal maintenance?
Select an answer first
35foundation · easy
What is the primary purpose of security awareness training in mitigating social engineering?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Malware, Phishing, and Social Engineering SCE Practice Questions (Page 7)

Questions 31–35

A phishing attack targets a specific senior executive by name and uses information about their role to craft a convincing email. This technique is called:

A user receives a text message claiming to be from their bank, stating that their account has been locked and they must click a link to verify their identity. The user is unsure if the message is legitimate. Which action is the safest for the user to take?

A small business wants to protect its employees from malware delivered via email attachments and drive-by downloads. They have a limited budget and no dedicated IT staff. Which approach provides the most comprehensive protection with minimal maintenance?

What is the primary purpose of security awareness training in mitigating social engineering?

Keep studying — Fundamentals of Cyber Threats