Social Engineering practice questions

Vishing, because the attacker is using a voice call to pressure the user

Why wrong: Vishing uses a phone call or voice channel, not a text message with a link.

Baiting, because the attacker is offering a free service upgrade

Why wrong: Baiting usually relies on a tempting lure, while this message uses urgency and account fear.

Tailgating, because the attacker is trying to enter a building behind someone else

Why wrong: Tailgating is a physical access attack and has nothing to do with SMS messages.

On-path attack

Why wrong: Incorrect. An on-path (formerly man-in-the-middle) attack involves the attacker intercepting and possibly altering communications between two parties. In this scenario, the attacker hosted a fake login page that the victims visited directly; there is no indication of intercepted traffic between the user and the legitimate service.

Brute-force attack

Why wrong: A brute-force attack is an automated, systematic trial-and-error method where an attacker submits many password combinations (often using tools like Hydra or John the Ripper) against an authentication endpoint until one succeeds. In this scenario, the attacker did not guess credentials but instead used a deceptive phishing page to trick users into voluntarily submitting their passwords. The defining element is social engineering, not computational guessing, so classifying this as brute-force would misidentify the attack vector and undermine the correct mitigation strategy.

Password spraying

Why wrong: Incorrect. Password spraying attempts a small number of commonly used passwords against a large number of accounts. The scenario involves a targeted attack that harvested credentials from multiple users via a fake login page, not a low-and-slow password guessing technique.

Average time to patch critical vulnerabilities in production systems

Why wrong: This is a vulnerability management metric that reflects patching speed, risk prioritization, and IT operational efficiency, not the security knowledge or behavior of employees. While critical for reducing exposure, it depends on system administrators and automated processes rather than on the awareness curriculum, so it is not a valid measure of the training program's impact.

Number of firewall rule changes approved per quarter

Why wrong: This is a network administration and change management metric that counts firewall rule changes, which are typically driven by application requirements, business need, or security engineering work. It does not involve employee knowledge or decision-making, and it measures operational throughput rather than the effectiveness or reach of a security awareness program.

Percentage of servers with full disk encryption enabled

Why wrong: This is a data-at-rest protection metric that measures the percentage of servers configured with full disk encryption, a technical control enforced by IT policies and system settings. It is a configuration management and endpoint security measure, unrelated to employee awareness or training, and therefore does not evaluate the awareness program's success.

Spear phishing

Why wrong: Spear phishing is a targeted cyberattack that occurs via email or electronic messaging, in which the attacker customizes the content for a specific victim or organization to increase credibility, often enticing the victim to click a malicious link or open an attachment. The attack vector relies on digital text-based communication that can be filtered or analyzed by security tools. In this scenario, the communication channel is a phone call, not email; hence, while the attacker may use a pretext, the lack of any link, attachment, or email component makes spear phishing technically inapplicable, and vishing is the correct voice-specific term.

Pretexting

Why wrong: Pretexting is the act of creating a fabricated scenario (pretext) to obtain information, and it can be used across different communication channels. While the attacker does use a pretext in this scenario, 'vishing' is the more specific term when the attack occurs via phone. In the context of CompTIA Security+, vishing is the best answer because it directly identifies the medium (voice).

Tailgating

Why wrong: Tailgating is a physical security attack in which an unauthorized person follows an authorized individual through a secured entrance, doorway, or checkpoint to gain entry without presenting their own credentials. This attack requires in-person presence at a restricted facility and typically exploits the authorized person's courtesy or inattention to access control measures. Because the scenario involves a phone call rather than physical proximity, tailgating cannot occur; the attacker is not physically following anyone, but is conducting a remote social engineering attempt.

Send the same annual awareness slide deck to everyone again without changing the content.

Why wrong: Sending the same annual awareness slide deck to everyone again without changing the content will not resolve the behavioral gaps highlighted in the exhibit. The data shows that executives and customer support have disproportionately high click rates and near-zero reporting rates, which generic, annual, static content fails to address. Repeated, unchanged material leads to habituation and offers no practice or reinforcement, so it is an ineffective awareness action.

Block all external email so users cannot click suspicious messages.

Why wrong: Blocking all external email is an excessively restrictive technical control that would severely disrupt business operations and legitimate communication. Even if it were implemented, it would not address the underlying awareness deficit because attackers can pivot to other vectors like internal phishing, compromised accounts, or web-based lures, and it provides no training on how to identify or report suspicious messages. Security awareness requires enabling users to make good decisions, not isolating them from all external contact.

Take no action because IT already reports suspicious messages well.

Why wrong: Taking no action because IT already reports suspicious messages well is a dangerous assumption, as the exhibit shows that other departments, particularly executives and customer support, have very low report rates. The overall security posture depends on every employee, not just IT, because attacks target all users, and a single high-performing group does not mitigate the risk posed by groups with weak detection and reporting behavior. Ignoring the exhibit's evidence of poor performance in other groups leaves the organization vulnerable to phishing and business email compromise.

The email contains a professional logo and a consistent signature block.

Why wrong: Attackers often copy logos, signatures, and branding from legitimate companies. Those elements can make the email look trustworthy, but they do not prove authenticity. They are weak indicators compared with workflow bypass and verification-blocking language.

The email uses correct spelling and grammar throughout.

Why wrong: Clean writing does not make a message legitimate. Many spear-phishing and pretexting emails are professionally written, especially when crafted by experienced attackers. Security decisions should rely on identity verification and process anomalies, not just presentation quality.

Baiting, because the caller is offering something valuable in exchange for action

Why wrong: Baiting is a social engineering technique that dangles an enticing object, download, or promise—like free media, a gift card, or a lost USB drive—to induce a victim into performing an action that compromises security. In this scenario, the caller offers no tangible reward; instead, they fabricate a believable identity and narrative to convince the technician to reset a password or grant access. The attack's core mechanism is a pretext for trust, not an irresistible offer, so it does not match baiting.

Vishing, because the attack happens by voice call

Why wrong: Vishing (voice phishing) is a delivery channel where attackers use phone calls to elicit sensitive information, often by spoofing caller ID to impersonate a bank or IT department. While this incident does occur over a call, vishing typically relies on generic urgency as the primary persuasive hook, such as 'your account is compromised, verify your SSN.' The technician here is manipulated by a detailed, false biography and procedural circumvention—hallmarks of pretexting, not the medium-specific phishing style. Thus, classifying it as vishing misidentifies the psychological tactic in favor of the transmission method.

Smishing, because the attacker is using a mobile device

Why wrong: Smishing is phishing conducted via SMS/text messaging, where a user receives a link to a fake login page or malware-laden download in a message. The scenario explicitly describes a real-time voice conversation, not a text exchange, so smishing cannot be the correct classification. Moreover, the attacker's effectiveness stems from pretexting—building a convincing backstory—rather than from any exploit of mobile messaging protocols. Therefore, smishing is wrong because it confuses the simple use of a telephone with a distinct, SMS-based attack vector.

Reply with the six-digit code so the help desk can complete the repair quickly.

Why wrong: Replying with the six-digit MFA code defeats the entire purpose of multi-factor authentication, which relies on a secret that only the legitimate user possesses. Once shared, the attacker can replay that code during a simultaneous login attempt or use it to complete a session hijacking attack, effectively granting unauthorized access to the account. The claim that the help desk needs the code for a repair is a social engineering pretext designed to exploit urgency and the user's trust in internal functions. No legitimate help desk will ever ask for a live MFA code, as doing so would compromise the security mechanism it is meant to protect.

Open the linked repair page from the email and sign in immediately to avoid suspension.

Why wrong: Clicking the linked repair page and signing in immediately is dangerous because the email's suspicious sender details and urgent language strongly indicate a phishing email. The link likely points to a credential-harvesting website designed to look like the legitimate login page, where any username and password entered are captured by the attacker. Moreover, if the page also requests an MFA code, the attacker can use it in real-time to authenticate as the user, completing a reverse proxy attack. Following links in unsolicited emails—especially ones that demand immediate action—bypasses all security training and hands over authentication credentials to a malicious third party.

Forward the message to the manager and continue using the account until the suspension occurs.

Why wrong: Forwarding the message to the manager and then continuing to use the account until a suspension occurs is not a form of verification and leaves the employee vulnerable to account compromise. The manager is not a substitute for the help desk's official verification channel, and waiting for a suspension that may never happen gives the attacker additional time to exploit the pretext or any information already gathered. The correct protocol is to immediately verify the request's legitimacy by contacting the help desk through a verified number or portal, not to defer responsibility or assume the threat is inactive. This option also fails to recognize that the email itself is the threat, so ongoing use of the account while an attacker is actively targeting it increases the risk of successful credential theft.

Spear phishing

Why wrong: Spear phishing is a targeted form of phishing that uses personalized information (e.g., the recipient's name) to increase credibility. The email in the scenario uses a generic greeting, indicating it is not tailored to specific individuals.

Vishing

Why wrong: Vishing, or voice phishing, is conducted over telephone systems, using VoIP spoofing and social engineering to impersonate legitimate callers or automated services. Because the observed incident involves emails with an external sender domain and generic greetings, the delivery vector is clearly electronic messaging, not voice. Even when vishing and phishing have similar malicious goals, the channel difference is the defining characteristic used to classify the attack.

Tailgating

Why wrong: Tailgating is a physical security threat where an unauthenticated individual follows an authorized employee through a door or controlled barrier, often exploiting courtesy or distraction. This scenario describes a digital email-based deception, not an attempt to gain physical access to a restricted facility. Although both rely on social engineering, tailgating requires proximity and fails when applied to a remote email campaign.

Buy the gift cards immediately so the CEO is not delayed.

Why wrong: Acting on the email's urgency is exactly the psychological trigger used in gift card and Business Email Compromise scams; the attacker relies on the employee skipping verification to avoid 'delaying' the CEO. Even if the display name and signature match, the message can be spoofed or originate from a compromised account, so purchasing cards immediately converts untraceable funds to the attacker. Legitimate executives rarely demand urgent gift card purchases via email, and most organizations' policies require confirming financial requests through a known, separate channel, making this action both financially and procedurally dangerous.

Forward the email to coworkers so they can watch for the same request.

Why wrong: Broadly forwarding the email to coworkers exposes them to the same malicious links, attachments, or reply-to addresses and may spread phishing lures beyond the intended target. It also contaminates the incident response picture: security teams need original headers and metadata to trace spoofing, but forwarding strips or alters that evidence and can generate a second wave of requests from confused users. Instead of acting as an ad hoc distribution list, the employee should report the message through the approved security channel so the SOC can analyze it and alert the organization safely.

Reply to the sender and ask for more details in the same email thread.

Why wrong: Replying in the same email thread is not a valid verification because the attacker may control the 'CEO's' mailbox, or a spoofed domain can make the response appear to come from inside the organization. This interaction confirms that the address is active and can prompt the attacker to double down or send follow-up phishing attempts, and it bypasses the organization's detection controls because the exchange remains hidden from security monitoring. Only out-of-band contact—such as calling the CEO on a previously known number or using an authenticated collaboration tool—can establish whether the request is real.

Tap the link and complete the MFA reset immediately

Why wrong: Tapping the link in an unsolicited text message is dangerous because it can lead to a credential-harvesting site that mimics the legitimate MFA prompt, capturing both the password and the one-time code. This is a common SMiShing technique that enables real-time relay or replay attacks, potentially allowing the attacker to bypass MFA and gain unauthorized access. The urgency of an 'act immediately' request is a social engineering trigger designed to bypass the user's critical thinking, so the correct response is to ignore the link and verify through a trusted channel.

Forward the text to coworkers so they can watch for it too

Why wrong: Forwarding the text to coworkers amplifies the threat by spreading a suspected malicious link to additional recipients, increasing the likelihood that someone will click it and compromise their credentials. This also converts the employee from a victim into an unwitting distributor of the phishing campaign, which can cause a wider organizational breach. Instead, the message should be reported to the security or IT help desk through the approved internal process so that the incident response team can block the domain, analyze the payload, and alert others without exposing them to the link.

Reply to the sender and ask for more details

Why wrong: Replying to the sender is counterproductive because it confirms that the phone number is active and monitored, which likely adds the target to a list for future phishing, vishing, or SMS spam campaigns. It also provides no verification of the request's legitimacy, as an attacker can simply fabricate credentials or escalate the social engineering. The only safe way to handle a suspicious MFA text is to ignore the reply option and independently confirm the request through a known company contact method, such as the help desk number on the corporate intranet, before taking any action.

SMS one-time code, because it is widely supported and easy for users to adopt.

Why wrong: While SMS one-time codes are convenient and provide an additional authentication factor, they are not phishing-resistant because the SMS channel can be compromised via SIM-swapping attacks, where an attacker asks the carrier to port the victim's number to a device they control. Even without porting, the code can be intercepted by malicious apps with SMS permission or through signaling system vulnerabilities, and a real-time relay can forward the one-time code to the legitimate site to defeat the second factor. NIST SP 800-63B now deprecates SMS for out-of-band verification, underscoring that it is unsuitable for privileged administrator authentication.

Email one-time link, because it can be delivered to any mailbox quickly.

Why wrong: Email one-time links are functionally tied to the security of the mailbox infrastructure and the user's email account, not to a dedicated phishing-resistant device or possession factor. An attacker who gains access to the mailbox, or who is positioned to intercept email in transit, can click the link or extract the embedded token and authenticate as the user without their consent. Additionally, an email link can be manually forwarded by the user under a phishing duress scenario, and it does not cryptographically bind the authentication request to the legitimate destination, so it fails the requirement for a phishing-resistant factor.

Authenticator app TOTP code, because it adds a second factor without special hardware.

Why wrong: TOTP authenticator apps add a true possession factor because the secret key is stored on the user's device, but they lack origin binding, meaning the one-time code is not cryptographically tied to the specific website or application being accessed. An adversary-in-the-middle proxy, such as a real-time phishing kit that simply mounts a live relay, can capture the user's username and password, ask the user for the current TOTP code, and replay it to the legitimate site within the 30-second validity window, successfully authenticating as the user. This vulnerability to real-time intercept and replay is precisely why TOTP is considered a legacy second factor and is not classified as phishing-resistant for privileged access.

Phishing

Why wrong: Phishing typically involves deceptive emails or fraudulent websites with malicious links or attachments designed to harvest credentials. This attack occurs entirely over a live phone call, with no email or web content involved, so the more precise classification is vishing—voice phishing—rather than generic phishing.

Baiting

Why wrong: Baiting relies on luring a victim with an attractive offer, such as a free download, contaminated USB drive, or fake prize, to trigger a specific action like inserting a device or clicking a link. The exhibit shows an attacker impersonating support staff on a call to directly coax an MFA code, not offering any digital or physical bait, so baiting does not apply.

Pretexting

Why wrong: Pretexting describes the broader tactic of fabricating a believable story to establish false legitimacy, but it is channel-agnostic—it could happen via email, chat, or in person. The exhibit specifically depicts a phone call with urgent requests and caller ID spoofing, which points to vishing as the precise attack type, even though a pretext is being used.

Baiting

Why wrong: Baiting is a social engineering attack that relies on offering the target something tempting, such as a free USB drive, discounted software, or a charging cable, to trigger action. The attacker's goal is to entice the victim into inserting, downloading, or physically retrieving the object, which often carries malware or leads to credential capture. Here, the person at reception offers no such lure; they present a story about a scheduled maintenance task, so the distinction is that baiting appeals to greed or curiosity rather than manipulating trust or authority. It is a different failure mode because the victim must take possession of or interact with the bait.

Smishing

Why wrong: Smishing (SMS phishing) is a vectored social engineering attack delivered exclusively through text messages, usually containing deceptive URLs or requests for personal information. It exploits mobile messaging trust and often uses urgent language to prompt immediate clicks, but it cannot describe an in-person conversation at a reception desk. The media mismatch is the core reason it is incorrect here: the scenario involves synchronous physical presence, not an asynchronous digital message. Since the attacker is physically presenting a badge, the attack vector is human contact, not SMS infrastructure.

Ransomware

Why wrong: Ransomware is a type of malicious software that encrypts a victim's files or system and demands a ransom payment for decryption. It is a technical payload, not a social engineering narrative, and would be relevant long after initial access is achieved, e.g., if the attacker planted a USB later. The scenario describes the initial social engineering step to get past reception; ransomware has nothing to do with the ruse of a forgotten badge or contracting identity. Choosing this option would confuse a delivery mechanism with an attack phase, whereas pretexting is the actual tactic in play.

Phishing

Why wrong: Phishing is the overarching term for social engineering attacks that use fraudulent messages to trick recipients into disclosing sensitive information or downloading malware, but it traditionally encompasses email, VoIP, and other channels. While the payroll text qualifies as phishing in the broadest sense, the specific delivery via SMS requires the more precise label of smishing, so it is not the best answer. The attack vector's unique characteristics, like limited spam filtering on SMS, make the distinction important for incident response.

Pretexting

Why wrong: Pretexting is a social engineering technique where the attacker manufactures a convincing scenario, or pretext, to fabricate trust and extract information, often impersonating a coworker or authority figure. The payroll message may arguably contain a story, but the basis for classifying an attack is typically the delivery method and the direct attempt to steal credentials or install malware, not the narrative alone. Since the message is delivered by text and uses a standard phishing lure, it is more accurately a smishing attack, making pretexting an incorrect, though superficially plausible, choice.

Baiting

Why wrong: Baiting relies on piquing a victim's curiosity or greed with an enticing offer, such as free gifts, music downloads, or a dropped USB drive, which the victim must physically access or intentionally engage with. A payroll text does not present a separate lure; it creates a sense of urgency or concern about compensation, rather than appealing to the victim's desire to gain something. Because the attack is a direct request for action via text message without an external object or reward, it does not meet the definition of baiting, and smishing remains the proper answer.

Watering hole, because the attacker compromised the HR partner's website.

Why wrong: A watering hole attack works by compromising a website or third-party resource that the target population is known to visit, then using that site to deliver malware or redirects. Here, the attacker directly messages the worker on their phone instead of tampering with the HR partner's site, and no web compromise is described. The attack vector is outbound SMS, not a passive web-based infection, so this label does not match.

Spoofing only, because the attacker copied the HR logo in the message.

Why wrong: Spoofing appears here because the attacker copied the HR logo, but spoofing is a tactic, not the overall attack category. The message's purpose is to convince the worker to supply login credentials, which is phishing; when delivered by text, it is specifically smishing. Labeling it as merely spoofing would ignore the social-engineering objective and the SMS channel, which are central to the classification.

Port scanning, because the attacker wants to find open services on the phone.

Why wrong: Port scanning is a technical reconnaissance method that probes a device for open TCP/UDP ports and listening services, typically using tools like Nmap. The fraudulent text message targets the user's trust and does not interact with the phone's network stack. This description is about human manipulation via SMS, not automated network discovery, so port scanning is entirely unrelated.

Reply with the code because the request appears to come from payroll support.

Why wrong: Replying with the code—even if the sender appears to be payroll—is dangerous because the email is likely spoofed or from a compromised account. MFA codes are single-use secrets; sharing them allows an attacker to complete an authentication step or reset a password, effectively bypassing the second factor. Legitimate support teams never request one-time codes over email; any such request should be treated as a phishing indicator.

Forward the email to coworkers so they can watch for the same request.

Why wrong: Forwarding the email to coworkers increases the blast radius by spreading the malicious payload or links to additional inboxes. It also bypasses the established incident response chain, meaning the message might not be analyzed or blocked in a timely manner. The correct action is to report the message to the security team, which can extract headers, block the threat, and issue an organization-wide alert if necessary.

Open the attached file to see whether it contains the payroll fix details.

Why wrong: Opening the attached file is unsafe because phishing messages commonly deliver malware via attachments, such as macro-laden Office documents or executable scripts. The attachment could contain ransomware, credential-stealing trojans, or exploit code targeting unpatched software. The employee should avoid engaging with the payload and instead report the message, allowing the security team to detonate the file in a sandboxed environment for analysis.

Tailgating, because the attacker is trying to enter a secure area physically.

Why wrong: Tailgating, also known as piggybacking, exploits physical access controls by following an authorized person through a secure doorway without presenting credentials. The described attack is purely digital and relies on psychological manipulation via email to obtain a one-time code, with no physical presence or access-control bypass involved. Tailgating would require the attacker to be at the facility and does not explain the request for a secret code.

DDoS, because the message is designed to overwhelm the mailbox server.

Why wrong: A distributed denial-of-service (DDoS) attack aims to exhaust a target server's or network's resources by flooding it with traffic from many compromised systems. It is an availability attack, not a confidentiality attack, and does not involve sending a deceptive email or requesting a one-time passcode. The email targets a single user's trust and secrets, whereas DDoS would be directed at the mail server's infrastructure and would not require a response from the victim.

Shoulder surfing, because the attacker is watching the screen from nearby.

Why wrong: Shoulder surfing is a direct observation attack where the attacker visually captures sensitive data, such as a one-time code, by looking over the victim's shoulder or using recording devices. This scenario involves an email-based request, so the threat actor never needs to be physically near the victim. Even if the attacker later uses the code, the initial compromise vector is a fabricated communication, not line-of-sight surveillance.

A single password policy for all users

Why wrong: A single password policy for all users is ineffective because it fails to account for varying risk levels across different systems and roles. For example, an administrative account requires longer, more complex passwords and stricter rotation than a standard user, but a uniform policy either under-protects privileged accounts or overburdens typical users, encouraging insecure behavior. This approach is not a layered control; it is a one-size-fits-all measure that provides no defense-in-depth benefit.

Using only one antivirus solution for all endpoints

Why wrong: Using only one antivirus solution creates a single point of failure, as every endpoint relies on the same detection signatures and heuristics, which malicious actors can specifically evade. A truly layered defense incorporates multiple overlapping tools—such as EDR, application whitelisting, and intrusion detection—that cover different attack vectors. Deploying just one AV product avoids this diversity and leaves the environment vulnerable to modern polymorphic malware and zero-days.

Disabling all logging to save storage space

Why wrong: Disabling all logging removes the detective and reactive layer that is essential for identifying and investigating security incidents. Logs provide the forensic evidence needed to determine how an attacker gained access, what they exfiltrated, and which systems need recovery. Without this visibility, even if other controls like a firewall or MAC are bypassed, the breach may go undetected for months, rendering other layers less effective—a direct violation of the defense-in-depth principle.

Presence of a digital signature from a trusted certificate authority

Why wrong: A digital signature from a trusted certificate authority is not an indicator of phishing; rather, it is an authenticity and integrity mechanism that verifies the signer's identity and guarantees the message was not altered. Phishing emails almost never carry valid digital signatures from CAs, and their presence generally suggests a legitimate, signed corporate communication. Therefore, seeing a trusted CA signature should decrease suspicion, not serve as a phishing red flag.

A request for sensitive information via a secure web portal

Why wrong: A request for sensitive information via a secure web portal is actually a security best practice, not a phishing indicator, because legitimate services use HTTPS-encrypted portals for credential submission. Phishing instead directs victims to lookalike domains or embedded forms that do not carry the same trusted portal characteristics. The presence of a secure portal with a valid certificate and recognized URL indicates safe handling of data, so this option is incorrect as a phishing sign.