Social Engineering Fundamentals GOAA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security consultant is assessing an organization's resilience to social engineering. The consultant has identified that the organization has strong email security but employees frequently use personal devices for work. Which vector should the consultant prioritize in the assessment to exploit the weakest link?

   • AVishing to the corporate help desk
   • BIn-person tailgating at the office
   • CPhishing via corporate email
   • DSmishing to personal devices
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is planning a social engineering engagement against a target organization. The tester has identified that the organization's help desk is outsourced and that employees frequently post about their projects on LinkedIn. The tester decides to craft an email that appears to come from the IT department, referencing a specific project the target is working on, and asks the target to click a link to 'verify their account' due to a 'security audit'. Which stage of the social engineering attack cycle is the tester primarily in when crafting this email?

   • AExecution and exploitation
   • BPretexting and development
   • CDebrief
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise has a mature security awareness program but continues to see successful vishing attacks. The CISO wants to implement a control that reduces the impact of vishing without adding friction to legitimate help desk calls. Which approach best balances security and usability?

   • AImplementing a call-back verification process where help desk agents call back on a known number before making changes
   • BPublishing a policy that forbids employees from sharing any personal information over the phone
   • CRequiring all help desk calls to be authenticated with a one-time passcode sent to the employee's mobile device
   • DDisabling all phone-based password resets
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A security manager is designing a defense-in-depth strategy against social engineering. The organization has a high rate of successful phishing and vishing attacks. Which of the following combinations of controls would provide the most comprehensive defense?

   • ATechnical controls only, such as email filtering and endpoint protection
   • BUser training only, since employees are the first line of defense
   • CA policy that prohibits all personal communication during work hours
   • DTechnical controls such as email filtering and MFA, combined with user training and a clear verification policy
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A red team is conducting a social engineering engagement and has reached the debrief stage. The team is preparing a report for the client. Which of the following is the most important element to include in the debrief?

   • AA summary of the attack timeline
   • BAn analysis of which employees were most susceptible and why
   • CA detailed list of the tools and techniques used during the attack
   • DActionable recommendations for improving security awareness and controls
   Reveal Solution Discussion Select an answer first