Social Engineering Fundamentals GOAA Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   An organization is reviewing its incident response after a smishing attack that compromised several mobile devices. The attack used SMS messages that appeared to be from the company's IT help desk, asking users to click a link to 'update their mobile device certificate'. The link led to a malicious app installation. Which of the following countermeasures would have been most effective in preventing the installation of the malicious app?

   • ARequiring users to change their passwords every 90 days
   • BImplementing DMARC for the company's email domain
   • CConducting vishing simulations to train users on phone-based attacks
   • DEnforcing a mobile device management (MDM) policy that blocks installation of apps from unknown sources
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A social engineering consultant is planning an in-person engagement. The consultant has gathered detailed information about the target's organizational structure, internal jargon, and the name of the facility manager. The consultant plans to dress as a maintenance worker and claim to need access to a server room to 'check the HVAC'. Which stage of the attack cycle does this preparation represent, and which psychological trigger is being used?

   • ADebrief; liking
   • BExecution; scarcity
   • CDevelopment; authority
   • DReconnaissance; authority
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is designing a phishing simulation for a company where employees are highly educated but overconfident in their ability to detect phishing. The team wants to measure susceptibility while also improving detection skills. Which approach best addresses the overconfidence bias and provides actionable data?

   • ASend a highly sophisticated phishing email that mimics a real attack and track who clicks
   • BConduct a survey asking employees to rate their ability to detect phishing
   • CSend a very obvious phishing email to ensure high detection rates
   • DSend a moderate-difficulty phishing email and, for those who click, display a training message explaining the cues they missed
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization has implemented strong email filtering and user training for phishing. However, a recent incident involved an attacker calling the finance department, pretending to be the CEO, and instructing an urgent wire transfer to a 'new vendor'. The call appeared to come from a number that matched the CEO's office. Which attack vector was used, and what additional control would have been most effective in preventing this specific incident?

   • APhishing; deploy an email gateway that blocks spoofed sender addresses
   • BIn-person social engineering; enforce a two-person rule for wire transfers
   • CSmishing; require multi-factor authentication for all financial systems
   • DVishing; implement a call-back verification procedure for financial transactions
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization is considering implementing a security awareness program that includes simulated phishing, vishing, and smishing campaigns. The budget is limited, and the CISO wants to prioritize the vector that poses the highest risk based on the organization's threat model. The organization has recently experienced a successful smishing attack that led to a data breach. Which factor should most influence the decision?

   • AThe likelihood and impact of each vector based on recent incidents
   • BThe cost of each simulation platform
   • CThe preference of the security team
   • DThe ease of implementing each simulation
   Reveal Solution Discussion Select an answer first