Social Engineering CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common social engineering attack vector?

   • AMan-in-the-middle attack
   • BSQL injection
   • CPhishing
   • DDenial-of-service attack
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security tester is conducting a social engineering test for a law firm. The tester sends an email to employees that appears to be from the IT department, stating that there is a critical security update and that employees must click a link to install it immediately. The email warns that failure to do so will result in account suspension. Which psychological principle is the tester primarily exploiting?

   • AUrgency
   • BReciprocity
   • CScarcity
   • DSocial proof
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security tester is explaining to a client why social engineering is a critical component of a comprehensive security assessment. The client believes that technical controls are sufficient to protect the organization. Which statement BEST justifies the need for social engineering testing?

   • ASocial engineering testing is the only way to detect phishing attacks
   • BSocial engineering testing can replace all other security testing methods
   • CSocial engineering testing is required by all industry regulations
   • DSocial engineering testing reveals vulnerabilities in the human element that technical controls cannot address
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is performing a social engineering assessment for a technology company. The tester leaves several USB drives in the company parking lot, each labeled 'Confidential - Employee Bonus Information.' The tester hopes that curious employees will plug the drives into their work computers. Which social engineering vector is being used?

   • ABaiting
   • BTailgating
   • CPretexting
   • DPhishing
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security tester is planning a social engineering test for a client. The client is concerned about the potential for employees to become upset or to have their trust in the organization damaged. The client wants to minimize the negative impact while still conducting a meaningful test. Which approach BEST balances the need for testing with ethical considerations?

   • AConduct the test only on a small group of volunteers
   • BSkip the social engineering test entirely to avoid any negative impact
   • CConduct the test without informing employees, to get the most realistic results
   • DInform employees that a social engineering test will occur, but not the exact method or timing
   Reveal Solution Discussion Select an answer first