Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CEH Social Engineering and Physical Security Practice Question
Drag and drop the steps to perform a successful social engineering attack in a penetration test into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Research, Craft Pretext, Choose Channel, Execute, Document
In a social engineering penetration test, the correct sequence is Research (gather intelligence on the target), Craft Pretext (create a believable scenario), Choose Channel (select communication medium), Execute (deliver the attack), and Document (record findings). This order ensures the attack is tailored and effective, as each step builds on the previous one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Research, Craft Pretext, Choose Channel, Execute, Document
Why this is correct
This is the correct order because social engineering attacks begin with researching the target to gather intelligence, then crafting a believable pretext based on that information, selecting the appropriate communication channel, executing the attack, and finally documenting the results for the penetration test report.
- ✗
Choose Channel, Research, Craft Pretext, Execute, Document
Why it's wrong here
Starting with "Choose Channel" is a critical misstep because the selection of the communication medium (e.g., email, phone, in-person) is a tactical decision that must be informed by prior intelligence gathering and the specific narrative developed. Without first researching the target to understand their habits and crafting a believable pretext, an attacker cannot effectively determine the most appropriate and convincing channel to deliver the social engineering attempt, significantly reducing its chances of success.
- ✗
Execute, Research, Craft Pretext, Choose Channel, Document
Why it's wrong here
Beginning a social engineering operation with "Execute" is fundamentally flawed and highly improbable to succeed. Effective social engineering relies on meticulous preparation, including thorough research to identify vulnerabilities and a carefully constructed pretext to manipulate the target. Attempting to execute an attack without this foundational intelligence and a credible story would be a haphazard and easily detectable endeavor, lacking the necessary psychological groundwork to bypass human defenses.
- ✗
Research, Choose Channel, Craft Pretext, Execute, Document
Why it's wrong here
While "Research" is the correct initial step, placing "Choose Channel" before "Craft Pretext" is an incorrect sequence. The pretext, which is the deceptive scenario designed to elicit a specific action, should logically precede channel selection. The nature of the pretext (e.g., urgency, formality, required interaction type) dictates the most effective communication channel. Selecting a channel prematurely risks choosing a medium that does not adequately support or enhance the credibility of the crafted narrative, thereby undermining the attack's psychological impact.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.