Creating Phishing Emails with AI GOAA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security consultant is planning a phishing simulation for a client. The client has provided written authorization. Which additional step is most important to ensure the simulation remains ethical?

   • ASend the phishing email to all employees, including those not in the authorized scope.
   • BEnsure that the simulation does not collect or store personal data beyond what is necessary for the test.
   • CUse the most realistic phishing email possible, including real employee credentials.
   • DAvoid informing the client about the simulation details to ensure realism.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security researcher is analyzing a phishing email that was sent to multiple employees. The email is personalized with each recipient's name and job title, and it references a recent company event. The researcher suspects the email was generated by an AI model. Which additional evidence would most strongly support this suspicion?

   • AThe email has a consistent structure and tone across all recipients, with no variations in style.
   • BThe email contains a request to verify account credentials.
   • CThe email was sent from a domain that is similar to the company's domain.
   • DThe email includes a link to a website that is similar to the company's official site.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration testing firm is contracted to assess a client's security. The client has authorized phishing simulations but has a strict policy that no real employee data may be used. The tester wants to use AI to generate a highly convincing email. What is the best approach?

   • AAsk the client to relax the policy so the email can be more convincing.
   • BUse publicly available information about the company, such as the CEO's name and recent news, to craft a realistic email without using internal employee data.
   • CGenerate a generic email without personalization to avoid using any employee data.
   • DUse the employee directory from the client's internal system to personalize the email.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing an email that claims to be from the company's HR department. The email uses a formal tone, addresses the recipient by name, and mentions a recent company policy change. Which cue is most likely to indicate that the email was generated by an AI model rather than a human?

   • AThe email was sent during business hours.
   • BThe email addresses the recipient by their full name.
   • CThe email has an unusually consistent and generic tone with no typos or personal quirks.
   • DThe email contains a link to a website that is not the official HR portal.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a suspicious email that was flagged by the spam filter. The email is well-written, has a professional tone, and includes the recipient's name and company. However, the analyst notices that the email uses the phrase 'I hope this email finds you well' and has a generic greeting. Which of the following is the most likely indicator that this email is AI-generated?

   • AThe email uses a generic greeting and a common phrase like 'I hope this email finds you well' that is often overused by AI models.
   • BThe email has a professional tone and is well-written.
   • CThe email was flagged by the spam filter.
   • DThe email includes the recipient's name and company, which is a common personalization technique.
   Reveal Solution Discussion Select an answer first