Social Engineering CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why do social engineering attacks often create a sense of urgency?

   • ATo comply with legal requirements
   • BTo make the victim feel important
   • CTo prevent the victim from thinking critically and verifying the request
   • DTo give the victim more time to complete the task
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security tester is explaining social engineering to a new client. The client asks, 'Why would a penetration tester use social engineering when we have firewalls and antivirus?' Which response BEST explains the role of social engineering in security testing?

   • ASocial engineering is required by law for all security assessments
   • BSocial engineering is a substitute for technical testing
   • CSocial engineering tests the human element, which is often the weakest link in security
   • DSocial engineering is used to bypass firewalls and antivirus
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security tester is conducting a social engineering test for a retail company. The tester calls an employee in the accounting department, pretending to be a vendor who has not received a payment. The tester asks the employee to verify the company's bank account details to 'resolve the issue.' The employee, wanting to be helpful, provides the information. Which psychological principle is the tester exploiting?

   • AReciprocity
   • BSocial proof
   • CTrust
   • DScarcity
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has experienced several successful phishing attacks where employees clicked on malicious links. The security team wants to implement a countermeasure that directly reduces the likelihood of employees falling for phishing emails. Which option is the MOST effective?

   • AImplement a spam filter that blocks all emails with links
   • BConduct regular security awareness training that includes simulated phishing exercises
   • CDisable HTML in all incoming emails
   • DRequire employees to change their passwords every 30 days
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is assessing a company's resistance to social engineering. The tester wants to test whether employees will disclose sensitive information over the phone. The tester calls the IT helpdesk, claims to be a remote employee who has forgotten their password, and asks the helpdesk to reset it. The helpdesk employee complies without verifying the caller's identity. Which social engineering vector is being used?

   • ATailgating
   • BPhishing
   • CPretexting
   • DBaiting
   Reveal Solution Discussion Select an answer first