Social Engineering Fundamentals GOAA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has experienced multiple successful smishing attacks where employees clicked malicious links in text messages. The security team is evaluating countermeasures. Which combination of controls would be most effective in reducing the risk from smishing specifically?

   • AConduct regular vishing simulations and implement a call-back verification process for phone requests
   • BImplement email authentication (SPF, DKIM, DMARC) and train users to hover over links in emails
   • CRequire multi-factor authentication (MFA) for all corporate applications and enforce strong password policies
   • DDeploy an SMS gateway filter and enforce mobile device management (MDM) policies that block sideloading of apps
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A red team is planning a social engineering campaign against a target organization. The team has limited time and budget. They need to choose between a phishing campaign and an in-person pretexting attack. The organization has strong email security but weak physical security. Which decision best aligns with the attack cycle and the organization's weaknesses?

   • AUse vishing because it is low-cost and can be automated
   • BConduct a phishing campaign because it is cheaper and easier to scale
   • CConduct an in-person pretexting attack because physical security is weak, and the attack cycle can be executed effectively
   • DUse smishing because it bypasses email security
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization wants to reduce the risk of smishing attacks against its employees. Which combination of defensive strategies would be most effective?

   • ABlocking all SMS messages on corporate devices
   • BProviding employees with a reporting mechanism for suspicious texts and conducting awareness training on smishing
   • CRequiring employees to use a separate phone for work
   • DPublishing a policy that prohibits personal phone use at work
   Reveal Solution Discussion Select an answer first
5. 19application · medium · select all that apply

   A company has recently experienced several social engineering incidents, including a vishing attack that tricked an employee into revealing their password and a phishing email that led to a malware infection. The security team is planning a comprehensive defense. Select all that apply: Which of the following countermeasures would be effective in reducing the risk of both vishing and phishing?

   • AProviding regular security awareness training that covers both email and phone-based attacks
   • BDeploying an email gateway that blocks malicious attachments and links
   • CImplementing multi-factor authentication (MFA) for all user accounts
   • DDisabling all external phone calls to the organization
   • EEstablishing a clear policy for verifying unusual requests, such as calling back a known number
   Check answers Discussion Select an answer first
6. 20foundation · easy

   In the social engineering attack cycle, which stage directly follows the attacker's initial information-gathering about the target?

   • AExecution
   • BDebrief
   • CEstablishing rapport
   • DPlanning
   Reveal Solution Discussion Select an answer first