220-1202 Social Engineering Attacks — 10 Questions

Question 1

An employee finds a USB drive labeled 'Employee Salary Info Q4' in the parking lot. Out of curiosity, they plug it into their work computer to see the contents. What type of social engineering attack is this an example of?

Accepted Answer

Baiting. This is baiting, where an attacker leaves a physical item (like a USB drive) in a location where it is likely to be found and used. The enticing label is the 'bait' that exploits human curiosity.

Answer

Phishing

Answer

Tailgating

Answer

Pretexting

Question 2

A new employee receives an email that appears to be from the company's HR department, asking them to click a link to verify their direct deposit information for payroll. The email contains the company logo and looks professional. What is the most likely social engineering attack?

Accepted Answer

Phishing. This is a phishing attack, specifically a form of spear phishing targeting a new employee. The email uses social engineering tactics (urgency, authority) to trick the recipient into clicking a malicious link that could steal credentials or install malware.

Answer

Whaling

Answer

Vishing

Answer

Shoulder surfing

Question 3

A user calls the help desk, frantic because their banking app shows an unauthorized transfer of $500. They say they received a call earlier from 'bank security' asking them to install a remote access tool to 'verify their account'. What type of social engineering attack did the user fall victim to?

Accepted Answer

Vishing. This is a classic vishing (voice phishing) attack combined with a tech support scam. The attacker used a phone call to impersonate a trusted entity and tricked the user into installing remote access software, giving the attacker control over the device to perform fraudulent transactions.

Answer

Phishing

Answer

Smishing

Answer

Shoulder surfing

Question 4

A technician is troubleshooting a user's slow computer. The user mentions they received a call from 'Windows Support' saying their computer had a virus. The user gave the caller remote access to 'fix' it. Now, the computer is running slower and has strange pop-ups. What is the most likely consequence of this social engineering attack?

Accepted Answer

The attacker installed a keylogger to steal credentials and sensitive data.. By giving remote access, the user likely allowed the attacker to install malware, such as ransomware, spyware, or a backdoor. The slow performance and pop-ups are symptoms of malware infection. The technician should immediately disconnect the computer from the network and perform a full security scan.

Answer

The computer is now part of a botnet used for DDoS attacks.

Answer

The computer's BIOS has been corrupted.

Answer

The hard drive has been physically damaged.

Question 5

A user reports receiving an email that appears to be from their CEO, urgently requesting that they purchase $500 in gift cards and reply with the codes. The email address looks slightly off (e.g., ceo@cornpany.com instead of ceo@company.com). What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack, a type of phishing that targets high-profile individuals or impersonates them to trick lower-level employees. The attacker used a spoofed email address to impersonate the CEO and create a sense of urgency.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 6

A technician receives an email from what appears to be the company's CEO, asking for a list of all employee passwords for a 'security audit'. The email address is correct, but the tone and request are unusual. The technician suspects a social engineering attack. What is the best course of action?

Accepted Answer

Forward the email to the security team and do not respond.. This is likely a whaling or spear phishing attack impersonating the CEO. The technician should never share passwords and should verify the request through a separate communication channel (e.g., phone call or in-person) before taking any action. Reporting to the security team is also critical.

Answer

Reply to the email asking for more details to confirm the request.

Answer

Provide the list as requested, since the CEO has authority.

Answer

Call the CEO immediately to verify the request.

Question 7

A receptionist at a company receives a call from someone claiming to be from the IT department. The caller says they need her password to perform an urgent server update. The receptionist provides the password. What type of social engineering attack is this?

Accepted Answer

Pretexting. This is a classic example of pretexting, where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. The caller impersonated an IT staff member to establish trust and authority.

Answer

Tailgating

Answer

Phishing

Answer

Baiting

Question 8

During a security audit, a technician notices that an unauthorized person is standing just behind an employee at the secure door, waiting for the employee to badge in so they can enter without badging themselves. What type of social engineering attack is being attempted?

Accepted Answer

Tailgating. This is tailgating (or piggybacking), where an unauthorized person follows an authorized individual into a restricted area without proper authentication. The attacker is exploiting the employee's politeness or lack of awareness.

Answer

Pretexting

Answer

Baiting

Answer

Phishing

Question 9

A user calls the help desk because they received a pop-up on their screen claiming their computer is infected with a virus and to call a toll-free number for immediate support. The user did not call the number. What should the technician advise the user to do?

Accepted Answer

Close the pop-up and run a full antivirus scan.. This is a tech support scam, a form of social engineering that uses scare tactics (fake virus warnings) to trick users into calling a fake support line. The user should close the pop-up and run a security scan to ensure no malware was installed.

Answer

Call the number to see if it's legitimate.

Answer

Ignore the pop-up and continue working.

Answer

Reboot the computer immediately.

Question 10

A technician is configuring a new employee's workstation. The employee mentions that a 'friendly IT guy' from the help desk called earlier and asked for their username and temporary password to 'pre-setup the account'. The employee provided the information. What should the technician do first?

Accepted Answer

Reset the employee's password and report the incident to the security team.. This is a social engineering attack where the attacker posed as IT support. The technician should immediately report the incident to the security team and flag the account as compromised, as the credentials are now in the hands of an attacker.

Answer

Proceed with the setup as planned, since the employee already provided the info.

Answer

Call the help desk to verify if they made the call.

Answer

Tell the employee it was likely a test and to ignore it.