Social Engineering Attacks practice questions

Phishing

Why wrong: Phishing is typically electronic (email, websites). Baiting involves a physical object left to tempt the victim.

Tailgating

Why wrong: Tailgating involves following someone into a secure area. This scenario involves a found USB drive.

Pretexting

Why wrong: Pretexting involves creating a fabricated scenario to obtain information. This scenario uses a physical object, not a story.

Whaling

Why wrong: Whaling targets senior executives, not new employees. The target here is a new employee, making phishing a better fit.

Vishing

Why wrong: Vishing uses voice calls, not email. This attack is email-based.

Shoulder surfing

Why wrong: Shoulder surfing involves observing someone's screen or keyboard. This attack is electronic, not observational.

Phishing

Why wrong: Phishing typically uses email or text messages, not a direct phone call. The attack vector here was a voice call, making vishing the more precise term.

Smishing

Why wrong: Smishing uses SMS text messages, not phone calls. The attack here was initiated via a phone call, not a text.

Shoulder surfing

Why wrong: Shoulder surfing involves looking over someone's shoulder to obtain information, such as passwords. This scenario involves a phone call and remote access, not direct observation.

The computer is now part of a botnet used for DDoS attacks.

Why wrong: While possible, this is not the most immediate or likely consequence. The symptoms (pop-ups, slowness) suggest a more direct malware infection.

The computer's BIOS has been corrupted.

Why wrong: BIOS corruption is rare from remote access attacks. The symptoms are more consistent with software-level malware.

The hard drive has been physically damaged.

Why wrong: Physical damage is unlikely from a remote access attack. The issues are software-related.

Spear phishing

Why wrong: Spear phishing targets a specific individual, but whaling is a more specific term when the target or impersonated person is a senior executive. While related, whaling is the best answer here.

Vishing

Why wrong: Vishing uses voice calls, not email. This attack was conducted via email.

Tailgating

Why wrong: Tailgating is a physical security breach, not an email-based attack.

Reply to the email asking for more details to confirm the request.

Why wrong: Replying to the attacker confirms the email address is valid and may lead to further social engineering. Verification should be done through a separate channel.

Provide the list as requested, since the CEO has authority.

Why wrong: Sharing passwords is never acceptable, even from a legitimate source. This would be a massive security breach.

Call the CEO immediately to verify the request.

Why wrong: While verification is good, the technician should not take any action that could compromise security without first consulting the security team. Forwarding to security is the priority.

Tailgating

Why wrong: Tailgating involves following an authorized person into a restricted area without proper authentication. This scenario involves a phone call, not physical access.

Phishing

Why wrong: Phishing typically uses electronic communication like email or fake websites. This attack was conducted over the phone, making pretexting a more accurate description.

Baiting

Why wrong: Baiting offers something enticing (like a free USB drive) to trick victims. This scenario involves a direct request for information, not an offer.

Pretexting

Why wrong: Pretexting involves a fabricated story, not physical proximity. The attacker here is using physical presence, not a story.

Baiting

Why wrong: Baiting uses an enticing item to lure the victim. This scenario involves following someone through a door.

Phishing

Why wrong: Phishing is an electronic attack, not a physical one. This is a physical security breach.

Call the number to see if it's legitimate.

Why wrong: Calling the number would engage with the scammers, potentially leading to further compromise. The user should never call the number.

Ignore the pop-up and continue working.

Why wrong: Ignoring the pop-up might be okay, but it's better to take proactive steps like running a scan to ensure the system is clean. The pop-up could be a sign of adware.

Reboot the computer immediately.

Why wrong: Rebooting might temporarily remove the pop-up, but it doesn't address potential underlying malware. A scan is a better first step.

Proceed with the setup as planned, since the employee already provided the info.

Why wrong: This is dangerous because the credentials have been compromised. Continuing as normal could lead to a security breach.

Call the help desk to verify if they made the call.

Why wrong: While verification is good, the priority is to secure the compromised account first. The technician should not wait for verification before taking action.

Tell the employee it was likely a test and to ignore it.

Why wrong: Dismissing the incident as a test is irresponsible. The technician must treat it as a genuine security threat and follow proper incident response procedures.

Phishing

Why wrong: Phishing is digital (email, websites), not physical USB drops.

Pretexting

Why wrong: Pretexting involves a fabricated story, not leaving physical bait.

Tailgating

Why wrong: Tailgating is about following someone into a secure area, not using physical media.

Phishing

Why wrong: While related, phishing typically involves email or text; this specific phone-based attack is called vishing.

Smishing

Why wrong: Smishing uses SMS text messages, not voice calls.

Pretexting

Why wrong: Pretexting involves fabricating a scenario, but vishing is the specific term for phone-based social engineering.

Reply to the email asking for verification.

Why wrong: Replying could confirm to the attacker that the email address is active, and they may send a convincing response.

Click the link to see if it looks legitimate.

Why wrong: Clicking the link could lead to malware infection or credential harvesting, even if you don't enter data.

Call the phone number listed in the email signature.

Why wrong: The phone number could be fake or belong to the attacker; using official directory numbers is safer, but forwarding is more direct for analysis.

Phishing

Why wrong: Phishing involves digital deception, not physical access through following someone into a building.

Pretexting

Why wrong: Pretexting involves fabricating a scenario to obtain information, not simply following someone through a door.

Baiting

Why wrong: Baiting involves offering something enticing (like a free USB drive) to trick victims, not physically following someone.

Phishing

Why wrong: Phishing is a digital attack, not directly facilitated by a physical password note.

Tailgating

Why wrong: Tailgating is about physical access, not observing written credentials.

Baiting

Why wrong: Baiting involves luring with an offer, not simply observing a written password.

Tailgating; install mantraps at entrances.

Why wrong: Tailgating involves following someone in, not using a fake identity. Mantraps prevent tailgating but not pretexting.

Phishing; implement email filtering.

Why wrong: Phishing is digital; email filtering does not prevent physical impersonation.

Baiting; disable USB ports on workstations.

Why wrong: Baiting involves luring with an offer; disabling USB ports does not address physical impersonation.

Phishing

Why wrong: Phishing typically uses email or fake websites to steal credentials, not pop-ups offering free software.

Pretexting

Why wrong: Pretexting involves fabricating a scenario to gain information, not offering free software to install malware.

Shoulder surfing

Why wrong: Shoulder surfing involves visually observing information, not interacting with pop-ups.

Provide the password immediately to prevent a data breach.

Why wrong: Providing credentials over the phone without verification is a major security risk and exactly what social engineers want.

Ignore the call because IT never calls about updates.

Why wrong: While suspicious, ignoring the call without verifying could miss a legitimate issue; verification is the proper step.

Change the password and give them the new one.

Why wrong: Changing the password does not solve the problem; the attacker would still obtain valid credentials.

Check the user's email for phishing messages.

Why wrong: While email could be a vector, the physical access incident is more directly related to the unusual activity.

Verify the delivery person's identity with the shipping company.

Why wrong: Verification is good, but the immediate priority is to contain and assess potential damage from the access.

Disable the user's network access permanently.

Why wrong: This is an overreaction; the user may be a victim, not the attacker, and disabling access could hinder investigation.

Shoulder surfing

Why wrong: Shoulder surfing involves looking over someone's shoulder to obtain information, not sending deceptive emails.

Tailgating

Why wrong: Tailgating is a physical security breach where an unauthorized person follows an authorized person into a restricted area.

Dumpster diving

Why wrong: Dumpster diving involves searching through trash for discarded documents or media containing sensitive information, not sending emails.