Social Engineering Fundamentals GOAA Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A security team is analyzing a successful social engineering attack where an employee transferred funds to an attacker. The attacker impersonated the company's CFO and used urgency, claiming an 'audit deadline'. The employee later stated they 'didn't want to question the CFO'. Which combination of human factors and psychological triggers best explains the employee's behavior?

   • AScarcity and social proof
   • BReciprocity and liking
   • CAuthority bias and urgency
   • DCommitment and consistency
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A red team is conducting a social engineering engagement against a target organization. The team has completed reconnaissance and is now in the development stage. They have identified that the organization uses a specific internal portal for expense reports and that employees frequently receive emails from the finance department. The team wants to create a phishing email that will be effective. Which of the following actions is most aligned with the development stage and will best increase the likelihood of success?

   • APreparing a debrief report for the client
   • BCalling the help desk to verify the email addresses of the finance department
   • CCrafting an email that mimics the internal portal's notification style and includes a link to a fake login page
   • DSending the phishing email immediately to a small test group to gauge reactions
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which individual countermeasure is most appropriate when receiving an unexpected phone call from someone claiming to be from your company's IT department asking for your password?

   • AAsk the caller for their employee ID before providing the password
   • BProvide the password only if the caller sounds professional
   • CGive the password but then change it immediately
   • DHang up and call the IT department using a known official number
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which cognitive bias is most directly exploited when an attacker sends a fake email that appears to come from a colleague who frequently asks for help with IT issues?

   • AAnchoring bias
   • BFamiliarity bias
   • CHalo effect
   • DConfirmation bias
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security awareness program is being updated to help employees resist social engineering. The program currently covers phishing emails but not other vectors. Which addition would best address the human factors that make employees susceptible to vishing and smishing?

   • AAdding a module on recognizing urgency and authority cues in phone calls and text messages
   • BRequiring employees to change passwords monthly
   • CConducting annual penetration tests
   • DImplementing a spam filter for SMS messages
   Reveal Solution Discussion Select an answer first