CEH Practice Question: Malware, Social Engineering and Network Attacks
During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?
⚠ Common exam trap
A common mix-up: candidates confuse the medium (phone call) with the technique, incorrectly selecting vishing (Option B) instead of recognizing that the core deception is the fabricated pretext, not the voice channel itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pretexting
Pretexting is the correct answer because the attacker fabricates a scenario (the pretext of being a new employee with a locked account) to manipulate the help desk into performing a password reset. This technique relies on a crafted story to gain trust and bypass security procedures, rather than using technical exploits or direct requests for information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Phishing
Why it's wrong here
Phishing is a broad social engineering technique primarily characterized by attempting to acquire sensitive information (like usernames, passwords, and credit card details) by masquerading as a trustworthy entity in an electronic communication. While it can encompass various digital channels, its most common and defining vector is email, often involving malicious links or attachments. The scenario describes a phone call, which is not the primary or typical medium for phishing.
- ✗
Vishing
Why it's wrong here
Vishing, or voice phishing, specifically leverages telephone calls to trick individuals into divulging personal information or performing actions that compromise security. While it uses a phone call, similar to the scenario, the key distinction here is the method of deception. Vishing often relies on urgency or fear (e.g., "your bank account is compromised") to elicit immediate information, whereas the scenario implies a more elaborate, pre-planned fabricated story and identity, which is characteristic of pretexting.
- ✓
Pretexting
Why this is correct
Pretexting is a sophisticated form of social engineering where an attacker invents a believable, fabricated scenario (a "pretext") to manipulate a target into divulging information or performing an action. This often involves extensive research to create a credible backstory, a false identity, and a plausible reason for the interaction, making the target believe they are interacting with someone authorized or legitimate. The scenario's description of an attacker calling and using a fabricated scenario directly aligns with the definition of pretexting.
- ✗
Quid pro quo
Why it's wrong here
Quid pro quo, meaning "something for something," is a social engineering tactic where an attacker offers a perceived benefit or service in exchange for information or access. This could involve offering IT support to "fix" a non-existent problem in exchange for login credentials, or providing a small gift for sensitive data. The scenario describes an attacker using impersonation and a fabricated story to trick the target, not offering a reciprocal exchange of value for information.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.