220-1202 Social Engineering Attacks — 20 Questions

Question 1

An employee finds a USB drive labeled 'Employee Salary Info Q4' in the parking lot. Out of curiosity, they plug it into their work computer to see the contents. What type of social engineering attack is this an example of?

Accepted Answer

Baiting. This is baiting, where an attacker leaves a physical item (like a USB drive) in a location where it is likely to be found and used. The enticing label is the 'bait' that exploits human curiosity.

Answer

Phishing

Answer

Tailgating

Answer

Pretexting

Question 2

A new employee receives an email that appears to be from the company's HR department, asking them to click a link to verify their direct deposit information for payroll. The email contains the company logo and looks professional. What is the most likely social engineering attack?

Accepted Answer

Phishing. This is a phishing attack, specifically a form of spear phishing targeting a new employee. The email uses social engineering tactics (urgency, authority) to trick the recipient into clicking a malicious link that could steal credentials or install malware.

Answer

Whaling

Answer

Vishing

Answer

Shoulder surfing

Question 3

A user calls the help desk, frantic because their banking app shows an unauthorized transfer of $500. They say they received a call earlier from 'bank security' asking them to install a remote access tool to 'verify their account'. What type of social engineering attack did the user fall victim to?

Accepted Answer

Vishing. This is a classic vishing (voice phishing) attack combined with a tech support scam. The attacker used a phone call to impersonate a trusted entity and tricked the user into installing remote access software, giving the attacker control over the device to perform fraudulent transactions.

Answer

Phishing

Answer

Smishing

Answer

Shoulder surfing

Question 4

A technician is troubleshooting a user's slow computer. The user mentions they received a call from 'Windows Support' saying their computer had a virus. The user gave the caller remote access to 'fix' it. Now, the computer is running slower and has strange pop-ups. What is the most likely consequence of this social engineering attack?

Accepted Answer

The attacker installed a keylogger to steal credentials and sensitive data.. By giving remote access, the user likely allowed the attacker to install malware, such as ransomware, spyware, or a backdoor. The slow performance and pop-ups are symptoms of malware infection. The technician should immediately disconnect the computer from the network and perform a full security scan.

Answer

The computer is now part of a botnet used for DDoS attacks.

Answer

The computer's BIOS has been corrupted.

Answer

The hard drive has been physically damaged.

Question 5

A user reports receiving an email that appears to be from their CEO, urgently requesting that they purchase $500 in gift cards and reply with the codes. The email address looks slightly off (e.g., ceo@cornpany.com instead of ceo@company.com). What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack, a type of phishing that targets high-profile individuals or impersonates them to trick lower-level employees. The attacker used a spoofed email address to impersonate the CEO and create a sense of urgency.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 6

A technician receives an email from what appears to be the company's CEO, asking for a list of all employee passwords for a 'security audit'. The email address is correct, but the tone and request are unusual. The technician suspects a social engineering attack. What is the best course of action?

Accepted Answer

Forward the email to the security team and do not respond.. This is likely a whaling or spear phishing attack impersonating the CEO. The technician should never share passwords and should verify the request through a separate communication channel (e.g., phone call or in-person) before taking any action. Reporting to the security team is also critical.

Answer

Reply to the email asking for more details to confirm the request.

Answer

Provide the list as requested, since the CEO has authority.

Answer

Call the CEO immediately to verify the request.

Question 7

A receptionist at a company receives a call from someone claiming to be from the IT department. The caller says they need her password to perform an urgent server update. The receptionist provides the password. What type of social engineering attack is this?

Accepted Answer

Pretexting. This is a classic example of pretexting, where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. The caller impersonated an IT staff member to establish trust and authority.

Answer

Tailgating

Answer

Phishing

Answer

Baiting

Question 8

During a security audit, a technician notices that an unauthorized person is standing just behind an employee at the secure door, waiting for the employee to badge in so they can enter without badging themselves. What type of social engineering attack is being attempted?

Accepted Answer

Tailgating. This is tailgating (or piggybacking), where an unauthorized person follows an authorized individual into a restricted area without proper authentication. The attacker is exploiting the employee's politeness or lack of awareness.

Answer

Pretexting

Answer

Baiting

Answer

Phishing

Question 9

A user calls the help desk because they received a pop-up on their screen claiming their computer is infected with a virus and to call a toll-free number for immediate support. The user did not call the number. What should the technician advise the user to do?

Accepted Answer

Close the pop-up and run a full antivirus scan.. This is a tech support scam, a form of social engineering that uses scare tactics (fake virus warnings) to trick users into calling a fake support line. The user should close the pop-up and run a security scan to ensure no malware was installed.

Answer

Call the number to see if it's legitimate.

Answer

Ignore the pop-up and continue working.

Answer

Reboot the computer immediately.

Question 10

A technician is configuring a new employee's workstation. The employee mentions that a 'friendly IT guy' from the help desk called earlier and asked for their username and temporary password to 'pre-setup the account'. The employee provided the information. What should the technician do first?

Accepted Answer

Reset the employee's password and report the incident to the security team.. This is a social engineering attack where the attacker posed as IT support. The technician should immediately report the incident to the security team and flag the account as compromised, as the credentials are now in the hands of an attacker.

Answer

Proceed with the setup as planned, since the employee already provided the info.

Answer

Call the help desk to verify if they made the call.

Answer

Tell the employee it was likely a test and to ignore it.

Question 11

An employee finds a USB drive labeled 'Employee Bonuses Q4' in the parking lot and plugs it into their work computer to see the contents. The computer immediately begins exhibiting erratic behavior. Which social engineering attack was executed?

Accepted Answer

Baiting. This is a classic baiting attack using physical media. The attacker left a USB drive with an enticing label (bait) in a location where an employee would find it, hoping they would plug it in and execute malware.

Answer

Phishing

Answer

Pretexting

Answer

Tailgating

Question 12

A user reports receiving a phone call from someone claiming to be from 'Microsoft Support' saying their computer has a virus and asking for remote access to fix it. The user did not grant access. What type of attack was attempted?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack, a social engineering technique where the attacker uses phone calls to trick victims into providing sensitive information or remote access. Legitimate companies like Microsoft do not make unsolicited support calls.

Answer

Phishing

Answer

Smishing

Answer

Pretexting

Question 13

A technician receives an email that appears to be from the company's HR department asking them to click a link to update their direct deposit information. The email contains several grammatical errors and the sender's domain is 'company-hr.com' instead of the official 'company.com'. What is the most effective way to confirm this is a phishing attempt?

Accepted Answer

Forward the email to the company's security team for analysis.. The most reliable method is to verify the email's authenticity by checking the full email header and sender domain. Hovering over the link to see the actual URL can also reveal a phishing site, but checking the header confirms the source.

Answer

Reply to the email asking for verification.

Answer

Click the link to see if it looks legitimate.

Answer

Call the phone number listed in the email signature.

Question 14

A receptionist holds the door for a person carrying a large box, assuming they work in the building. Later, that person is seen plugging a USB drive into a workstation in the finance department. Which social engineering technique was most likely used to gain initial access?

Accepted Answer

Tailgating. Tailgating (or piggybacking) exploits human politeness and the natural instinct to hold doors for others, allowing unauthorized physical access. This attack often precedes other malicious actions like planting malware via USB.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 15

A technician is troubleshooting a printer issue and finds a sticky note under the keyboard with the domain admin password written on it. The user says they kept it there 'for convenience.' Which social engineering attack does this practice most enable?

Accepted Answer

Shoulder surfing. Writing down passwords in plain sight is a security risk that directly enables shoulder surfing or dumpster diving. An attacker who sees the note can easily gain unauthorized access.

Answer

Phishing

Answer

Tailgating

Answer

Baiting

Question 16

During a security audit, a technician discovers that an unauthorized person accessed a restricted server room by pretending to be a fire inspector. The person had a fake ID and clipboard. Which social engineering technique was used, and what is the best mitigation?

Accepted Answer

Pretexting; enforce visitor check-in and verification procedures.. This is pretexting, where the attacker created a false identity (fire inspector) to gain trust and access. The best mitigation is implementing strict verification procedures for all visitors, including calling the agency they claim to represent.

Answer

Tailgating; install mantraps at entrances.

Answer

Phishing; implement email filtering.

Answer

Baiting; disable USB ports on workstations.

Question 17

A customer complains that their computer is running slowly and they keep seeing pop-ups offering free antivirus software. They admit they clicked 'OK' on one pop-up. Which type of social engineering attack has likely occurred?

Accepted Answer

Baiting. This is a classic baiting attack where the attacker lures the victim with a free offer (antivirus) that actually installs malware. The pop-ups are a common delivery method for scareware or fake antivirus programs.

Answer

Phishing

Answer

Pretexting

Answer

Shoulder surfing

Question 18

A technician receives a call from someone claiming to be from the company's IT security team, asking for the administrator password to 'run a critical update.' The caller's voice sounds stressed and they mention a data breach. What should the technician do?

Accepted Answer

Ask for a callback number and verify it against the company directory.. This is a classic social engineering attempt using urgency and authority to pressure the victim into divulging credentials. The correct response is to verify the caller's identity through official channels before providing any sensitive information.

Answer

Provide the password immediately to prevent a data breach.

Answer

Ignore the call because IT never calls about updates.

Answer

Change the password and give them the new one.

Question 19

During a software deployment, a user reports that a stranger in a delivery uniform asked to use their computer to 'check a shipment status' and then quickly left. Later, the user notices unusual network activity. What should the technician investigate first?

Accepted Answer

Scan the workstation for malware and review recent system changes.. This scenario describes a pretexting attack where the attacker used a false identity (delivery person) to gain physical access to a computer. The technician should immediately check for unauthorized software or connections that may have been installed.

Answer

Check the user's email for phishing messages.

Answer

Verify the delivery person's identity with the shipping company.

Answer

Disable the user's network access permanently.

Question 20

A user calls the help desk claiming they received an urgent email from the CEO asking them to purchase gift cards for a client and reply with the codes. The user is suspicious because the email address looks slightly off. What type of social engineering attack is this?

Accepted Answer

Phishing. This is a classic phishing attack, specifically a form of spear phishing or whaling, where the attacker impersonates a high-level executive to trick the victim into performing an action. The slight alteration in the email address is a common indicator of a spoofed sender.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Dumpster diving