220-1202 Social Engineering Attacks Practice Test 2 — 15 Questions

Question 1

During a security audit, a technician discovers that an unauthorized person accessed a restricted server room by pretending to be a fire inspector. The person had a fake ID and clipboard. Which social engineering technique was used, and what is the best mitigation?

Accepted Answer

Pretexting; enforce visitor check-in and verification procedures.. This is pretexting, where the attacker created a false identity (fire inspector) to gain trust and access. The best mitigation is implementing strict verification procedures for all visitors, including calling the agency they claim to represent.

Answer

Tailgating; install mantraps at entrances.

Answer

Phishing; implement email filtering.

Answer

Baiting; disable USB ports on workstations.

Question 2

A customer complains that their computer is running slowly and they keep seeing pop-ups offering free antivirus software. They admit they clicked 'OK' on one pop-up. Which type of social engineering attack has likely occurred?

Accepted Answer

Baiting. This is a classic baiting attack where the attacker lures the victim with a free offer (antivirus) that actually installs malware. The pop-ups are a common delivery method for scareware or fake antivirus programs.

Answer

Phishing

Answer

Pretexting

Answer

Shoulder surfing

Question 3

A technician receives a call from someone claiming to be from the company's IT security team, asking for the administrator password to 'run a critical update.' The caller's voice sounds stressed and they mention a data breach. What should the technician do?

Accepted Answer

Ask for a callback number and verify it against the company directory.. This is a classic social engineering attempt using urgency and authority to pressure the victim into divulging credentials. The correct response is to verify the caller's identity through official channels before providing any sensitive information.

Answer

Provide the password immediately to prevent a data breach.

Answer

Ignore the call because IT never calls about updates.

Answer

Change the password and give them the new one.

Question 4

During a software deployment, a user reports that a stranger in a delivery uniform asked to use their computer to 'check a shipment status' and then quickly left. Later, the user notices unusual network activity. What should the technician investigate first?

Accepted Answer

Scan the workstation for malware and review recent system changes.. This scenario describes a pretexting attack where the attacker used a false identity (delivery person) to gain physical access to a computer. The technician should immediately check for unauthorized software or connections that may have been installed.

Answer

Check the user's email for phishing messages.

Answer

Verify the delivery person's identity with the shipping company.

Answer

Disable the user's network access permanently.

Question 5

A user calls the help desk claiming they received an urgent email from the CEO asking them to purchase gift cards for a client and reply with the codes. The user is suspicious because the email address looks slightly off. What type of social engineering attack is this?

Accepted Answer

Phishing. This is a classic phishing attack, specifically a form of spear phishing or whaling, where the attacker impersonates a high-level executive to trick the victim into performing an action. The slight alteration in the email address is a common indicator of a spoofed sender.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Dumpster diving

Question 6

A new employee is setting up their workstation and receives a phone call from someone claiming to be from the IT department. The caller says there is a critical security update and needs the employee's login credentials to install it remotely. What social engineering principle is the attacker primarily exploiting?

Accepted Answer

Authority. This scenario exploits the principle of authority, as the attacker impersonates a trusted IT department figure. Social engineers often use authority to bypass security protocols by making victims feel compelled to comply. The correct response is to never share credentials, regardless of who asks.

Answer

Urgency

Answer

Scarcity

Answer

Social proof

Question 7

A technician is investigating a data breach and discovers that an attacker obtained sensitive files by searching through the company's recycling bins. The bins contained printed reports with customer names and account numbers. What social engineering attack was used?

Accepted Answer

Dumpster diving. Dumpster diving is the physical act of searching through trash to find sensitive information. This attack relies on the failure to properly dispose of documents. Shredding or secure disposal policies are essential countermeasures.

Answer

Tailgating

Answer

Shoulder surfing

Answer

Phishing

Question 8

A technician is helping a customer configure a new laptop. The customer mentions they received a pop-up on their old computer warning of a virus and a phone number to call for support. The customer called the number and gave remote access to a 'technician' who then installed several programs. What social engineering attack occurred?

Accepted Answer

Tech support scam. This is a classic tech support scam, a form of social engineering where attackers use fake virus warnings to gain remote access. The pop-up is designed to scare the user into calling a fraudulent support number. Once access is granted, the attacker can install malware or steal data.

Answer

Shoulder surfing

Answer

Phishing

Answer

Dumpster diving

Question 9

During a routine security audit, a technician discovers that an unknown person has been using a badge to enter the building after hours. The badge belongs to a former employee who left the company six months ago. Which type of social engineering attack likely enabled this unauthorized access?

Accepted Answer

Tailgating. This describes tailgating, where an attacker follows an authorized person into a secure area without proper credentials. The use of a former employee's badge suggests the attacker may have obtained it through theft or social engineering. Proper badge deactivation upon termination is a key countermeasure.

Answer

Phishing

Answer

Dumpster diving

Answer

Shoulder surfing

Question 10

During a security audit, a technician finds that a user's workstation was infected with malware after the user inserted a USB drive found in the parking lot. The drive was labeled 'Employee Salary Info Q4'. What social engineering principle did the attacker exploit?

Accepted Answer

Baiting. This attack exploits curiosity and the baiting principle, where an attacker leaves a malicious device in a place where it will be found. The enticing label increases the likelihood of someone picking it up. This is a form of social engineering that relies on human psychology rather than technical vulnerabilities.

Answer

Scarcity

Answer

Pretexting

Answer

Tailgating

Question 11

A user reports that they received a voicemail from the company's HR director asking them to call back a number to verify their account details for payroll. The user is suspicious because the HR director is on vacation. What type of social engineering attack is this?

Accepted Answer

Vishing. This is vishing (voice phishing), where attackers use phone calls or voicemails to trick victims into revealing sensitive information. The impersonation of a known authority figure and the request for account details are classic signs. Vishing often leverages caller ID spoofing to appear legitimate.

Answer

Smishing

Answer

Pretexting

Answer

Pharming

Question 12

During a security incident investigation, a technician finds that an attacker called the help desk, pretended to be a new employee who forgot their password, and successfully reset it. The attacker knew the employee's name and department. Which social engineering technique was used?

Accepted Answer

Pretexting. Pretexting is the creation of a fabricated scenario (the pretext) to obtain information or access. The attacker used the employee's details to build credibility and trick the help desk. This highlights the importance of identity verification procedures.

Answer

Phishing

Answer

Tailgating

Answer

Shoulder surfing

Question 13

A user reports that they clicked a link in a text message that appeared to be from their bank, warning of suspicious activity. The link led to a realistic-looking login page, but the user realized it was fake after entering their credentials. What type of social engineering attack is this?

Accepted Answer

Smishing. This is smishing, which is phishing conducted via SMS text messages. The attacker uses urgency and a fake login page to steal credentials. Smishing is increasingly common due to the high trust users place in text messages.

Answer

Vishing

Answer

Pharming

Answer

Pretexting

Question 14

A security analyst notices that an attacker has been sending emails that appear to come from the company's internal email system, asking employees to click a link to update their shared drive password. The link leads to a fake login page. The attacker is using a spoofed internal domain. What specific type of phishing is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at specific individuals or groups within an organization. The use of a spoofed internal domain makes it more convincing. This contrasts with regular phishing, which is broader and less personalized.

Answer

Whaling

Answer

Vishing

Answer

Pharming

Question 15

A user calls the help desk, frantic because they received an email from what appears to be the CEO asking them to urgently purchase $500 in gift cards for a client and reply with the codes. The email address looks slightly off, and the signature is missing the usual legal disclaimer. What type of social engineering attack is this most likely an example of?

Accepted Answer

Phishing. This scenario describes a phishing attack, specifically a variant called whaling or CEO fraud, where the attacker impersonates a high-level executive. Phishing is the use of deceptive emails to trick users into revealing sensitive information or performing actions. The slightly off email address and missing disclaimer are classic indicators of a phishing attempt.

Answer

Shoulder surfing

Answer

Tailgating

Answer

Pretexting