The Impact of Human Behavior on Security Risks CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which technique is a social engineering attack that relies on creating a sense of urgency to trick a victim into acting quickly?

   • AUrgency-based pretexting
   • BDumpster diving
   • CTailgating
   • DShoulder surfing
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security tester is assessing a company's resilience to social engineering. The tester calls the help desk, pretends to be a new remote employee who forgot the onboarding password, and asks the help desk to reset it. The help desk agent, wanting to be helpful, resets the password without verifying the caller's identity. Which human factor is the tester primarily exploiting?

   • AThe agent's desire to be helpful and avoid conflict
   • BThe agent's carelessness with password hygiene
   • CThe agent's lack of security awareness training
   • DThe agent's lack of technical security controls
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has experienced several successful phishing attacks despite having a security awareness training program. The training is a yearly, hour-long video that employees must watch. Which improvement would be most effective in reducing the risk?

   • AIncrease the length of the yearly training video to two hours
   • BConduct frequent, simulated phishing campaigns with immediate feedback
   • COnly train employees who have fallen for phishing in the past
   • DMake the training video more entertaining with animations
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which scenario best illustrates a security risk caused by a lack of awareness rather than malicious intent?

   • AAn employee clicks a link in an email that appears to be from a colleague but is actually a phishing attempt
   • BAn employee disables the firewall on their work laptop to install unauthorized software
   • CAn employee intentionally copies confidential data to a personal USB drive to sell it
   • DAn employee shares their password with a coworker to help them meet a deadline
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company wants to reduce the risk of data exfiltration by negligent insiders who accidentally email sensitive data to external parties. Which control would be most effective?

   • AProvide security awareness training on email best practices
   • BDisable email forwarding to external addresses
   • CImplement a data loss prevention (DLP) solution that blocks emails containing sensitive data to external addresses
   • DRequire employees to encrypt all outgoing emails
   Reveal Solution Discussion Select an answer first