A penetration tester is conducting a social engineering assessment and wants to exploit the reciprocity bias in a target. Which of the following actions would best leverage this bias?

Leaving a small gift, such as a branded pen or coffee mug, on the target's desk before asking them to help with a 'survey'

Sending an email that claims the target has won a prize and must click a link to claim it

Impersonating a senior executive and demanding immediate action

Creating a fake social media profile that shares the target's interests and then asking for a connection

A security team is designing a phishing simulation to test employees' susceptibility to social engineering. They want to create an email that is most likely to succeed based on common cognitive biases. Which email design would best exploit the authority bias and the tendency to comply with requests from perceived superiors?

An email from a 'Colleague' saying 'I found a great deal on office supplies, check it out'

An email from 'HR' reminding employees to complete mandatory training by Friday

An email from 'IT Support' stating that the recipient's password expires in 24 hours and asking them to click a link to renew it

An email from the 'Chief Financial Officer' asking the recipient to urgently purchase gift cards for a client and keep it confidential

Which organizational countermeasure is most effective at reducing the success of phishing attacks that rely on urgency?

Requiring employees to use complex passwords

Conducting regular security awareness training

Implementing multi-factor authentication (MFA)

GIAC Offensive AI Analyst

Domain 1Objective 2

Social Engineering Fundamentals GOAA Practice Questions (Page 6)

Part of the AI Foundations and Social Engineering domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 26–30

26application · medium
A penetration tester is conducting a social engineering assessment and wants to exploit the reciprocity bias in a target. Which of the following actions would best leverage this bias?
Select an answer first
27application · medium
A security team is designing a phishing simulation to test employees' susceptibility to social engineering. They want to create an email that is most likely to succeed based on common cognitive biases. Which email design would best exploit the authority bias and the tendency to comply with requests from perceived superiors?
Select an answer first
28application · medium
A security awareness trainer is reviewing a recent phishing simulation that had a high click rate. The email used in the simulation claimed that the recipient's email account would be deactivated within 24 hours unless they clicked a link to 'renew their password'. The trainer wants to explain to management why this email was so effective. Which combination of psychological triggers and human factors best explains the success?
Select an answer first
29foundation · easy
Which organizational countermeasure is most effective at reducing the success of phishing attacks that rely on urgency?
Select an answer first
30foundation · easy
An attacker poses as a company's IT helpdesk manager and demands that an employee reset their password immediately. Which psychological trigger is primarily being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Social Engineering Fundamentals GOAA Practice Questions (Page 6)

Questions 26–30

A penetration tester is conducting a social engineering assessment and wants to exploit the reciprocity bias in a target. Which of the following actions would best leverage this bias?

Which organizational countermeasure is most effective at reducing the success of phishing attacks that rely on urgency?

An attacker poses as a company's IT helpdesk manager and demands that an employee reset their password immediately. Which psychological trigger is primarily being used?

Keep studying — AI Foundations and Social Engineering