CEH Social Engineering and Physical Security — 10 Questions

Question 1

A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?

Accepted Answer

Using a gelatin mold of an authorized user's fingerprint. Option C is correct because gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.

Answer

Shoulder surfing the authorized user's fingerprint pattern

Answer

Picking the lock on the server room door

Answer

Tailgating behind an authorized employee

Question 2

During a social engineering engagement, a tester calls the help desk posing as an employee from the IT department. The tester claims to be working on a critical system update and needs the employee's password to proceed. Which type of social engineering attack is being executed?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into divulging information. In this case, the tester falsely claims to be from the IT department working on a critical system update, which is a classic pretext to gain trust and obtain the employee's password. This differs from other social engineering types because it relies on a constructed identity and false narrative rather than a technical lure or direct exchange.

Answer

Quid pro quo

Answer

Baiting

Answer

Phishing

Question 3

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Accepted Answer

Implementing a mantrap at the entrance. A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.

Answer

Hiring security guards

Answer

Reviewing keycard access logs

Answer

Installing CCTV cameras

Question 4

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

Answer

Pharming

Answer

Spear phishing

Answer

Vishing

Question 5

Which TWO of the following are effective methods to prevent dumpster diving attacks? (Choose two.)

Accepted Answer

Shredding sensitive documents before disposal. Shredding sensitive documents before disposal (Option B) is effective because it physically destroys the information, making it impossible to reconstruct from discarded paper. This directly counters dumpster diving, where attackers retrieve documents to extract confidential data like passwords or network diagrams.

Answer

Storing all data on encrypted digital media only

Answer

Placing documents in recycling bins

Answer

Burning all discarded paper documents

Question 6

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

Accepted Answer

The communication creates a sense of urgency. Option C is correct because social engineers frequently fabricate a sense of urgency to bypass the victim's rational decision-making. By claiming an immediate deadline or threat (e.g., 'Your account will be locked in 24 hours'), the attacker pressures the target into acting without verifying the request, a tactic rooted in the psychological principle of scarcity.

Answer

The communication includes verifiable contact information

Answer

The sender uses a generic greeting like 'Dear Customer'

Question 7

Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?

Accepted Answer

ARP spoofing attack. The correct answer is C because the combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.

Answer

Distributed denial of service (DDoS) attack

Answer

MAC flooding attack

Answer

Ping flood attack

Question 8

You are a security consultant hired by a mid-sized company with 500 employees. The company has a central office with a lobby, reception, and two secure areas: the server room (requires keycard and PIN) and the executive floor (requires keycard only). Recently, employees have reported seeing unfamiliar people in restricted areas. Security logs show keycard access for the server room only during business hours, but no anomalies. However, the executive floor logs show multiple entries by a single employee, John from Sales, at odd hours. John claims he was working late. The company has a policy that all employees must wear ID badges visibly. You observe that employees often hold doors open for colleagues, and the receptionist does not verify visitor badges. Which of the following actions should you recommend FIRST to address the most likely attack vector?

Accepted Answer

Implement mantraps and enforce a policy of one person per keycard entry. The most likely attack vector is tailgating (piggybacking), where unauthorized individuals gain physical access by following an authorized employee through a secured door without using their own credentials. Option C directly addresses this by implementing mantraps (a small room with two interlocking doors that only allows one person to pass at a time) and enforcing a strict one-person-per-keycard-entry policy, which physically prevents tailgating. This is the first and most effective control because it mitigates the root cause—social engineering exploiting human courtesy—rather than focusing on symptoms like John's after-hours access or adding surveillance that doesn't prevent the act.

Answer

Investigate John's activities and consider disciplinary action

Answer

Upgrade keycard readers to biometric scanners

Answer

Install additional CCTV cameras in hallways

Question 9

A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. The attacker is fabricating a scenario (IT help desk performing a security update) to manipulate the target into revealing sensitive information. This is the essence of pretexting, where the attacker creates a false identity or situation to gain trust and extract data. Unlike phishing, which typically uses malicious links or attachments, this attack relies purely on verbal impersonation and social manipulation.

Answer

Tailgating

Answer

Quid pro quo

Answer

Phishing

Question 10

Which TWO of the following are effective physical security controls to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and the system verifies that only one person enters before allowing the second door to open. This design directly prevents tailgating by trapping unauthorized individuals who attempt to follow an authorized person through the first door.

Answer

Biometric door lock

Answer

CCTV cameras

Answer

Security guard