CEH Practice Question: Malware, Social Engineering and Network Attacks
A system administrator receives a phone call from someone claiming to be from IT support, asking for the administrator's password to 'fix a server issue'. This is an example of which social engineering attack?
⚠ Common exam trap
Candidates often confuse the delivery method (phone call) with vishing, but the CEH exam distinguishes pretexting by the use of a fabricated scenario or false identity, regardless of the communication channel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pretexting
Pretexting is a social engineering attack where the attacker fabricates a scenario (pretext) to manipulate the target into divulging sensitive information. In this case, the attacker impersonates IT support and invokes a fake server issue to create urgency, directly requesting the administrator's password. This aligns with the CEH definition of pretexting as a confidence-building deception, not a technical exploit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vishing
Why it's wrong here
Vishing is a form of social engineering that uses voice communication, typically phone calls, to trick individuals into divulging sensitive information. While it can involve automated calls, it also encompasses direct, live conversations where an attacker impersonates a trusted entity. The key characteristic is the use of voice to solicit information, often leveraging urgency or authority, but this scenario describes a targeted, fabricated story rather than a broad, automated attempt.
- ✗
Baiting
Why it's wrong here
Baiting involves luring victims with a promise of something desirable, such as free software, a reward, or access to exclusive content, often delivered via infected physical media like a USB drive or malicious downloads. The attacker relies on the victim's curiosity or greed to initiate an action that compromises their system or data. This specific scenario does not involve any such 'bait' or explicit promise of reward to entice the administrator.
- ✗
Phishing
Why it's wrong here
Phishing is a broad social engineering technique primarily conducted through electronic communication, most commonly email, but also SMS (smishing) or instant messaging. Attackers impersonate legitimate entities to trick recipients into clicking malicious links, opening infected attachments, or directly providing credentials on fake websites. The defining characteristic is the mass distribution of deceptive messages, aiming for a numbers game, rather than a targeted, interactive conversation.
- ✓
Pretexting
Why this is correct
Pretexting is a sophisticated social engineering attack where an attacker creates a believable, fabricated scenario, known as a 'pretext,' to manipulate a target into divulging sensitive information or performing a specific action. This often involves extensive research to build a convincing backstory and impersonate a legitimate individual or authority. The attacker maintains an interactive conversation, adapting the narrative to overcome skepticism and extract specific details, such as a password, under the guise of solving a problem or verifying identity.
Go deeper
Related to this question
Learn chapter
System Hacking
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
Key term
Nmap Scanning
Nmap scanning is a method used to discover devices running on a network and find open ports, services, and security weaknesses.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.