CEH Practice Question: Malware, Social Engineering and Network Attacks
An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?
⚠ Common exam trap
Test-takers frequently confuse Metasploit's exploit capabilities with social engineering, overlooking that SET is the dedicated tool for crafting and executing phishing campaigns, not just delivering payloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Social Engineering Toolkit (SET)
The Social Engineering Toolkit (SET) is specifically designed for social engineering attacks, including crafting convincing phishing emails that mimic internal departments like IT. It automates the creation of fake login pages and email templates, making it the most effective tool for testing employee susceptibility to password reset requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Social Engineering Toolkit (SET)
Why this is correct
The Social Engineering Toolkit (SET) is purpose-built for simulating various social engineering attacks, making it the ideal choice for testing employee susceptibility. It provides modules for spear phishing, credential harvesting, web jacking, and infectious media generator attacks, directly targeting the human element. By deploying these simulated threats, organizations can assess how employees react to realistic social engineering tactics and identify areas for security awareness training improvement.
- ✗
Wireshark
Why it's wrong here
Wireshark functions as a powerful network protocol analyzer, primarily used for capturing and interactively browsing network traffic in real-time. While invaluable for network troubleshooting, protocol development, and security analysis at the packet level, it does not possess any capabilities for directly engaging with or manipulating human behavior. Therefore, it cannot be used to test an employee's susceptibility to psychological manipulation or phishing attempts.
- ✗
Metasploit
Why it's wrong here
Metasploit is a comprehensive penetration testing framework focused on vulnerability exploitation, payload generation, and post-exploitation activities against systems. Although it can deliver payloads that might originate from a social engineering vector, its core function is system compromise, not the initial human interaction phase of a social engineering test. While it can complement tools like SET by providing the exploitation component, it is not the primary tool for assessing human susceptibility to social engineering tactics directly.
- ✗
Nmap
Why it's wrong here
Nmap, or Network Mapper, is an open-source utility designed for network discovery and security auditing, primarily by scanning for open ports, identifying services, and fingerprinting operating systems on target hosts. Its functionality is entirely focused on network-level reconnaissance and enumeration of technical infrastructure, not on interacting with or influencing human users. Consequently, Nmap lacks any features to simulate social engineering attacks or measure an individual's response to such psychological manipulation.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.