A company has been hit by a vishing attack where an attacker impersonated the CEO and convinced an employee to purchase gift cards. The company wants to implement controls to prevent this type of attack. Select all that apply: Which of the following controls would be effective in mitigating vishing attacks?

Establishing a policy that no financial transactions are authorized solely based on a phone call

Implementing a call-back verification procedure for any request involving money or sensitive data

Training employees to recognize vishing techniques and to report suspicious calls

Deploying an email security gateway that blocks phishing emails

Using caller ID to verify the identity of all incoming calls

During the debrief stage of a social engineering attack cycle, what is the primary purpose for the attacker?

To establish authority with the target

To review what worked and what did not, and to secure any obtained data

To gather initial information about the target

A security awareness program is being evaluated after a year of training. Despite training, employees still fall for phishing emails that use urgency and authority. Which of the following changes to the program would be most effective in addressing the underlying cognitive biases?

Increasing the frequency of phishing simulations

Providing training that explains how cognitive biases work and how to pause and verify requests

Using more realistic phishing simulations that mimic real attacks

Implementing a reward system for employees who report phishing emails

GIAC Offensive AI Analyst

Domain 1Objective 2

Social Engineering Fundamentals GOAA Practice Questions (Page 8)

Part of the AI Foundations and Social Engineering domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 36–40

36application · medium
An attacker sends a text message to a target that appears to be from the target's bank, stating that a fraudulent transaction was detected and the target must call a provided number to resolve it. Which attack vector is being used, and what psychological trigger is likely exploited?
Select an answer first
37expert · medium · select all that apply
A company has been hit by a vishing attack where an attacker impersonated the CEO and convinced an employee to purchase gift cards. The company wants to implement controls to prevent this type of attack. Select all that apply: Which of the following controls would be effective in mitigating vishing attacks?
Select an answer first
38foundation · easy
During the debrief stage of a social engineering attack cycle, what is the primary purpose for the attacker?
Select an answer first
39application · medium
A security awareness trainer is designing a module to reduce susceptibility to phishing. The trainer wants to address the cognitive bias that makes employees more likely to comply with a request from someone who appears to be a senior executive. Which concept should the trainer emphasize?
Select an answer first
40expert · medium
A security awareness program is being evaluated after a year of training. Despite training, employees still fall for phishing emails that use urgency and authority. Which of the following changes to the program would be most effective in addressing the underlying cognitive biases?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Social Engineering Fundamentals GOAA Practice Questions (Page 8)

Questions 36–40

An attacker sends a text message to a target that appears to be from the target's bank, stating that a fraudulent transaction was detected and the target must call a provided number to resolve it. Which attack vector is being used, and what psychological trigger is likely exploited?

During the debrief stage of a social engineering attack cycle, what is the primary purpose for the attacker?

A security awareness trainer is designing a module to reduce susceptibility to phishing. The trainer wants to address the cognitive bias that makes employees more likely to comply with a request from someone who appears to be a senior executive. Which concept should the trainer emphasize?

A security awareness program is being evaluated after a year of training. Despite training, employees still fall for phishing emails that use urgency and authority. Which of the following changes to the program would be most effective in addressing the underlying cognitive biases?

Keep studying — AI Foundations and Social Engineering