Social Engineering Fundamentals GOAA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An attacker is planning a smishing campaign against a retail company's employees. The attacker has gathered employee phone numbers from a data breach and learned that the company uses a specific third-party benefits portal. The attacker sends a text message claiming that the employee's benefits enrollment is incomplete and includes a link to a fake portal. Which stage of the social engineering attack cycle does the attacker's action represent?

   • AReconnaissance
   • BExecution
   • CDebrief
   • DPretexting
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which psychological trigger is being exploited when an attacker sends an email claiming that a limited number of free tickets are available on a first-come, first-served basis?

   • AReciprocity
   • BSocial proof
   • CAuthority
   • DScarcity
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A social engineer sends an email to a target claiming that the target's account will be locked unless they verify their password within 15 minutes. The email includes a link to a fake login page. Which psychological trigger is being used, and which attack vector?

   • AUrgency and phishing
   • BScarcity and vishing
   • CReciprocity and in-person
   • DAuthority and smishing
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization is reviewing its security awareness program after a successful phishing attack that led to a ransomware infection. The attack used an email with a malicious attachment disguised as an invoice. Which of the following countermeasures would have been most effective in preventing the initial infection?

   • AConducting regular vishing simulations
   • BUser training on identifying phishing emails and a policy to verify unexpected attachments with the sender via a known channel
   • CImplementing DMARC to prevent domain spoofing
   • DDisabling USB ports on all workstations
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A penetration tester is conducting a social engineering assessment for a client. The tester has identified that the target organization's help desk uses a public phone number and that employees frequently post about their work on LinkedIn. The tester plans to call the help desk, impersonate a new remote employee, and request a password reset. Which attack vector and psychological trigger combination best describes this scenario?

   • APhishing with urgency
   • BVishing with authority
   • CSmishing with scarcity
   • DVishing with pretexting
   Reveal Solution Discussion Select an answer first