Social Engineering CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary characteristic of a tailgating attack?

   • AAn attacker leaves a malware-infected USB drive in a parking lot
   • BAn attacker pretends to be a technician to gain access to a server room
   • CAn attacker follows an authorized person into a restricted area without proper authentication
   • DAn attacker sends a fraudulent email to obtain login credentials
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key ethical consideration when conducting social engineering tests as part of security testing?

   • AKeeping the test results confidential from the organization
   • BEnsuring that the test causes maximum disruption to daily operations
   • CObtaining explicit permission from the organization before testing
   • DUsing real customer data to make the test more realistic
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security tester is planning a social engineering test for a client. The tester wants to send phishing emails to employees, but the client is concerned about the potential for employees to become upset or to have their trust in the organization damaged. Which ethical consideration should the tester address in the test plan?

   • AEnsure that the test is conducted without the knowledge of any employees
   • BUse only simulated attacks that do not involve any real data
   • CObtain written consent from the client and define the scope of the test
   • DGuarantee that no employee will be harmed or suffer negative consequences
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security tester is planning a social engineering test for a client. The client wants to test the effectiveness of their security awareness training. Which testing technique would be MOST appropriate?

   • ASend a simulated phishing email to all employees and track who clicks the link
   • BReview the organization's security policies
   • CConduct a survey asking employees if they would click on a phishing link
   • DInterview the security team about their training program
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security tester is conducting a social engineering assessment for a client. The tester has completed the test and is preparing the final report. The client asks the tester to include the names of employees who fell for the attacks so that they can be disciplined. Which action should the tester take?

   • ARefuse to include names and explain that the focus should be on systemic improvements
   • BInclude the names as requested, as the client has the right to know
   • CInclude the names only if the client signs a waiver
   • DInclude the names but recommend that no disciplinary action be taken
   Reveal Solution Discussion Select an answer first