How should I use these Social Engineering and Physical Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CEH · topic practice

Social Engineering and Physical Security practice questions

Q: Can I practise just Social Engineering and Physical Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Social Engineering and Physical Security domain.

Practise Certified Ethical Hacker CEH Social Engineering and Physical Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

17 questionsDomain: Social Engineering and Physical Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Social Engineering and Physical Security

Social Engineering and Physical Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Social Engineering and Physical Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Social Engineering and Physical Security questions

17 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Social Engineering and Physical Security explanation →

A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?

Trap 1: Shoulder surfing the authorized user's fingerprint pattern

Shoulder surfing is ineffective for capturing detailed fingerprint patterns needed for replication.

Trap 2: Picking the lock on the server room door

Lockpicking targets the door lock, not the biometric scanner.

Trap 3: Tailgating behind an authorized employee

Tailgating avoids the scanner but requires following someone in; it does not bypass the scanner mechanism.

Study all Social Engineering and Physical Security common traps →

A
Shoulder surfing the authorized user's fingerprint pattern
Why wrong: Shoulder surfing is ineffective for capturing detailed fingerprint patterns needed for replication.
B
Picking the lock on the server room door
Why wrong: Lockpicking targets the door lock, not the biometric scanner.
C
Using a gelatin mold of an authorized user's fingerprint
Gelatin molds can create replicas of fingerprints that may be accepted by some scanners.
D
Tailgating behind an authorized employee
Why wrong: Tailgating avoids the scanner but requires following someone in; it does not bypass the scanner mechanism.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Social Engineering and Physical Security explanation →

During a social engineering engagement, a tester calls the help desk posing as an employee from the IT department. The tester claims to be working on a critical system update and needs the employee's password to proceed. Which type of social engineering attack is being executed?

Trap 1: Quid pro quo

Quid pro quo involves an exchange of information for a service, not a false identity.

Trap 2: Baiting

Baiting uses a physical or digital lure, not a fabricated story.

Trap 3: Phishing

Phishing is usually conducted via email or messaging, not phone calls.

Study all Social Engineering and Physical Security common traps →

A
Quid pro quo
Why wrong: Quid pro quo involves an exchange of information for a service, not a false identity.
B
Baiting
Why wrong: Baiting uses a physical or digital lure, not a fabricated story.
C
Pretexting
Pretexting involves creating a false identity or scenario to extract information.
D
Phishing
Why wrong: Phishing is usually conducted via email or messaging, not phone calls.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Social Engineering and Physical Security explanation →

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Trap 1: Hiring security guards

Guards can be socially engineered or distracted.

Trap 2: Reviewing keycard access logs

Logs are for auditing, not prevention.

Trap 3: Installing CCTV cameras

CCTV is for monitoring, not preventing in real-time.

Study all Social Engineering and Physical Security common traps →

A
Hiring security guards
Why wrong: Guards can be socially engineered or distracted.
B
Reviewing keycard access logs
Why wrong: Logs are for auditing, not prevention.
C
Installing CCTV cameras
Why wrong: CCTV is for monitoring, not preventing in real-time.
D
Implementing a mantrap at the entrance
Mantraps physically enforce one-person entry, preventing tailgating.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Social Engineering and Physical Security explanation →

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Trap 1: Pharming

Pharming redirects users to fraudulent websites.

Trap 2: Spear phishing

Spear phishing targets a specific person, but does not necessarily impersonate a high-level executive.

Trap 3: Vishing

Vishing uses phone calls, not email.

Study all Social Engineering and Physical Security common traps →

A
Pharming
Why wrong: Pharming redirects users to fraudulent websites.
B
Spear phishing
Why wrong: Spear phishing targets a specific person, but does not necessarily impersonate a high-level executive.
C
Whaling
Whaling targets senior executives or impersonates them.
D
Vishing
Why wrong: Vishing uses phone calls, not email.

Full breakdown with real-world context →

Question 5mediummulti select

Read the full Social Engineering and Physical Security explanation →

Which TWO of the following are effective methods to prevent dumpster diving attacks? (Choose two.)

Trap 1: Storing all data on encrypted digital media only

Digital storage does not eliminate physical paper documents.

Trap 2: Placing documents in recycling bins

Recycling does not protect confidentiality.

Trap 3: Burning all discarded paper documents

Burning is effective but not always practical or allowed; not a standard recommendation.

Study all Social Engineering and Physical Security common traps →

A
Storing all data on encrypted digital media only
Why wrong: Digital storage does not eliminate physical paper documents.
B
Shredding sensitive documents before disposal
Shredding renders documents unreadable.
C
Using locked bins for discarded materials
Locked bins restrict physical access.
D
Placing documents in recycling bins
Why wrong: Recycling does not protect confidentiality.
E
Burning all discarded paper documents
Why wrong: Burning is effective but not always practical or allowed; not a standard recommendation.

Full breakdown with real-world context →

Question 6hardmulti select

Read the full Social Engineering and Physical Security explanation →

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

Trap 1: The communication includes verifiable contact information

Legitimate communications often include verifiable info.

Trap 2: The sender uses a generic greeting like 'Dear Customer'

Generic greetings are common in mass phishing but not definitive.

Study all Social Engineering and Physical Security common traps →

A
The communication includes verifiable contact information
Why wrong: Legitimate communications often include verifiable info.
B
The sender uses a generic greeting like 'Dear Customer'
Why wrong: Generic greetings are common in mass phishing but not definitive.
C
The communication creates a sense of urgency
Attackers often pressure targets to act quickly.
D
The message contains spelling or grammatical errors
Errors can indicate a fake message.
E
The request comes from someone claiming to be in authority
Impersonating authority figures is common.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Social Engineering and Physical Security explanation →

Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?

Network Topology

Trap 1: Distributed denial of service (DDoS) attack

No indication of multiple sources or high traffic.

Trap 2: MAC flooding attack

MAC flooding fills switch CAM table, not ARP table.

Trap 3: Ping flood attack

Ping flood is a DoS attack, not indicated by ARP anomalies.

Study all Social Engineering and Physical Security common traps →

A
Distributed denial of service (DDoS) attack
Why wrong: No indication of multiple sources or high traffic.
B
MAC flooding attack
Why wrong: MAC flooding fills switch CAM table, not ARP table.
C
ARP spoofing attack
Duplicate MAC addresses for different IPs indicate ARP spoofing.
D
Ping flood attack
Why wrong: Ping flood is a DoS attack, not indicated by ARP anomalies.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Social Engineering and Physical Security explanation →

You are a security consultant hired by a mid-sized company with 500 employees. The company has a central office with a lobby, reception, and two secure areas: the server room (requires keycard and PIN) and the executive floor (requires keycard only). Recently, employees have reported seeing unfamiliar people in restricted areas. Security logs show keycard access for the server room only during business hours, but no anomalies. However, the executive floor logs show multiple entries by a single employee, John from Sales, at odd hours. John claims he was working late. The company has a policy that all employees must wear ID badges visibly. You observe that employees often hold doors open for colleagues, and the receptionist does not verify visitor badges. Which of the following actions should you recommend FIRST to address the most likely attack vector?

Trap 1: Investigate John's activities and consider disciplinary action

John may be innocent; the issue is systemic tailgating.

Trap 2: Upgrade keycard readers to biometric scanners

Biometrics may help but do not prevent tailgating.

Trap 3: Install additional CCTV cameras in hallways

CCTV is reactive, not preventive.

Study all Social Engineering and Physical Security common traps →

A
Investigate John's activities and consider disciplinary action
Why wrong: John may be innocent; the issue is systemic tailgating.
B
Upgrade keycard readers to biometric scanners
Why wrong: Biometrics may help but do not prevent tailgating.
C
Implement mantraps and enforce a policy of one person per keycard entry
Mantraps physically prevent tailgating, addressing the most likely attack vector.
D
Install additional CCTV cameras in hallways
Why wrong: CCTV is reactive, not preventive.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Social Engineering and Physical Security explanation →

A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?

Trap 1: Tailgating

Tailgating requires physical following, not a phone call.

Trap 2: Quid pro quo

Quid pro quo involves offering a service or benefit in exchange for information.

Trap 3: Phishing

Phishing is usually via email or fake websites.

Study all Social Engineering and Physical Security common traps →

A
Pretexting
Pretexting uses a fabricated scenario to obtain information.
B
Tailgating
Why wrong: Tailgating requires physical following, not a phone call.
C
Quid pro quo
Why wrong: Quid pro quo involves offering a service or benefit in exchange for information.
D
Phishing
Why wrong: Phishing is usually via email or fake websites.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full Social Engineering and Physical Security explanation →

Which TWO of the following are effective physical security controls to prevent tailgating?

Trap 1: Biometric door lock

Biometric lock authenticates but does not prevent someone from following.

Trap 2: CCTV cameras

CCTV detects but does not prevent tailgating.

Trap 3: Security guard

Security guard is a personnel control, not a physical control device.

Study all Social Engineering and Physical Security common traps →

A
Biometric door lock
Why wrong: Biometric lock authenticates but does not prevent someone from following.
B
Mantrap
Mantrap requires one person to pass through and door to close before next opens, preventing tailgating.
C
CCTV cameras
Why wrong: CCTV detects but does not prevent tailgating.
D
Security guard
Why wrong: Security guard is a personnel control, not a physical control device.
E
Turnstile with one-way access
Turnstile physically restricts entry to one person per credential.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Social Engineering and Physical Security explanation →

Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?

Exhibit

Refer to the exhibit.

Exhibit:
C:\Users\jdoe> net user jdoe /domain
The request will be processed at a domain controller for domain corp.xyz.com.

User name                    jdoe
Full Name                    John Doe
Comment
User's comment
Country code                 001 (United States)
Account active               Yes
Account expires              Never

Password last set            6/15/2024 9:30:00 AM
Password expires             9/13/2024 9:30:00 AM
Password changeable          6/16/2024 9:30:00 AM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script                 logon.bat
User profile
Home directory               \\fileserver\home\jdoe
Last logon                   7/10/2024 2:15:00 PM

Logon hours allowed          All

Local Group Memberships      *Domain Users
Global Group memberships     *Domain Users
The command completed successfully.

Trap 1: User profile (C:\Users\jdoe)

User profile is a folder, not a specific file.

Trap 2: Home directory on \\fileserver\home\jdoe

Home directory is a network share, not a specific file.

Trap 3: Active Directory database (NTDS.dit)

NTDS.dit is on the domain controller, not the workstation.

Study all Social Engineering and Physical Security common traps →

A
User profile (C:\Users\jdoe)
Why wrong: User profile is a folder, not a specific file.
B
Home directory on \\fileserver\home\jdoe
Why wrong: Home directory is a network share, not a specific file.
C
logon.bat script
Logon scripts may contain credentials for network resources.
D
Active Directory database (NTDS.dit)
Why wrong: NTDS.dit is on the domain controller, not the workstation.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full NAT/PAT explanation →

A security auditor is assessing the physical security of a corporate office building that houses a data center. The building has a single main entrance with a reception desk staffed during business hours (8 AM to 6 PM). After hours, employees use a keycard reader to access the building. The data center itself requires a separate keycard and a 6-digit PIN. The auditor notices that during lunch hours (12-1 PM), the reception desk is often unattended, and employees frequently hold the door for others to avoid using their keycard. Additionally, a recent social engineering test revealed that an attacker was able to call the help desk, claim to be a new employee, and request a password reset, which was granted without proper verification. Based on this scenario, which of the following is the MOST effective combination of controls to mitigate both the physical and social engineering weaknesses?

Trap 1: Install a mantrap at the main entrance and require two-factor…

This only addresses physical tailgating, not the social engineering of password reset.

Trap 2: Deploy security guards at the entrance 24/7 and implement a policy…

Guards reduce tailgating but social engineering via phone remains.

Trap 3: Implement a callback verification process for all password reset…

This helps with social engineering but does not prevent tailgating during lunch.

Study all Social Engineering and Physical Security common traps →

A
Install a mantrap at the main entrance and require two-factor authentication for the data center door.
Why wrong: This only addresses physical tailgating, not the social engineering of password reset.
B
Install a mantrap at the main entrance and require multi-factor authentication (MFA) for all password reset requests.
Mantrap prevents physical tailgating; MFA on password resets mitigates social engineering.
C
Deploy security guards at the entrance 24/7 and implement a policy that all visitors must be escorted.
Why wrong: Guards reduce tailgating but social engineering via phone remains.
D
Implement a callback verification process for all password reset requests and require a manager approval.
Why wrong: This helps with social engineering but does not prevent tailgating during lunch.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full Social Engineering and Physical Security explanation →

An organization is implementing a social engineering defense program. Which TWO measures are most effective in reducing the risk of phishing attacks? (Choose two.)

Trap 1: Implement strong password policies with multi-factor authentication.

Passwords do not prevent users from clicking malicious links.

Trap 2: Enforce regular software updates and patch management.

Patching addresses technical vulnerabilities, not social engineering.

Trap 3: Deploy network segmentation and access control lists.

Segmentation limits damage but does not prevent phishing.

Study all Social Engineering and Physical Security common traps →

A
Implement strong password policies with multi-factor authentication.
Why wrong: Passwords do not prevent users from clicking malicious links.
B
Enforce regular software updates and patch management.
Why wrong: Patching addresses technical vulnerabilities, not social engineering.
C
Conduct regular security awareness training for all employees.
Training helps users identify and report phishing attempts.
D
Deploy network segmentation and access control lists.
Why wrong: Segmentation limits damage but does not prevent phishing.
E
Install advanced email filtering and anti-malware solutions.
Filters block many phishing emails before reaching users.

Full breakdown with real-world context →

Question 14hardmultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?

Exhibit

Refer to the exhibit.

```
Firewall Log:
Date: 2023-10-12
Time: 14:23:45
Source IP: 10.0.0.45
Destination IP: 192.168.1.100
Protocol: TCP
Port: 445
Action: ALLOW
User: jdoe
Reason: Rule ID 3 (SMB access to file server)
```

Exhibit:

Trap 1: Phishing

Phishing usually occurs via email or messaging, not direct SMB connections.

Trap 2: Vishing

Vishing is voice phishing, not related to network traffic.

Trap 3: Baiting

Baiting involves physical media like USB drives, not network logs.

Study all Social Engineering and Physical Security common traps →

A
Phishing
Why wrong: Phishing usually occurs via email or messaging, not direct SMB connections.
B
Vishing
Why wrong: Vishing is voice phishing, not related to network traffic.
C
Tailgating
Tailgating allows an attacker to physically enter a secured area and connect to the internal network from an unauthorized IP.
D
Baiting
Why wrong: Baiting involves physical media like USB drives, not network logs.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full Social Engineering and Physical Security explanation →

You are a security consultant for a mid-sized company with 500 employees. The company has a secure data center with a biometric access control system. Recently, a contractor was able to enter the data center without authorization by claiming he forgot his badge and an employee held the door for him. The contractor then accessed sensitive servers and exfiltrated data. The company wants to prevent such incidents. Which physical security control would be most effective in preventing this type of attack?

Trap 1: Install CCTV cameras to monitor the entrance.

CCTV is detective, not preventive.

Trap 2: Require employees to wear RFID badges at all times.

Badges do not prevent tailgating.

Trap 3: Hire additional security guards at the entrance.

Guards can be socially engineered.

Study all Social Engineering and Physical Security common traps →

A
Install CCTV cameras to monitor the entrance.
Why wrong: CCTV is detective, not preventive.
B
Require employees to wear RFID badges at all times.
Why wrong: Badges do not prevent tailgating.
C
Implement a mantrap with biometric and badge authentication.
Mantraps physically prevent tailgating by requiring one person at a time.
D
Hire additional security guards at the entrance.
Why wrong: Guards can be socially engineered.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full Social Engineering and Physical Security explanation →

Drag and drop the steps to perform a successful social engineering attack in a penetration test into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediummatching

Read the full wireless explanation →

Match each wireless attack to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Exploiting weak encryption in older Wi-Fi

Rogue access point mimicking a legitimate one

Forcing clients to disconnect from AP

Intercepting the 4-way handshake for cracking

Unauthorized access to Bluetooth devices

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Social Engineering and Physical Security sessions

Start a Social Engineering and Physical Security only practice session

Every question in these sessions is drawn from the Social Engineering and Physical Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Social Engineering and Physical Security questions →Mixed CEH session

Frequently asked questions

What does the CEH exam test about Social Engineering and Physical Security?: Social Engineering and Physical Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Social Engineering and Physical Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Social Engineering and Physical Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CEH topics?: Use the topic links above to move to related areas, or go back to the CEH question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CEH exam covers. They are not copied from any real exam or dump site.

Social Engineering and Physical Security only

10 questions 20 questions 30 questions 50 questions

Mixed CEH session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CEH questions Social Engineering and Physical Security domain overview CEH exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Social Engineering and Physical Security practice questions

What to know about Social Engineering and Physical Security

Common Social Engineering and Physical Security exam traps

Social Engineering and Physical Security questions

A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?

During a social engineering engagement, a tester calls the help desk posing as an employee from the IT department. The tester claims to be working on a critical system update and needs the employee's password to proceed. Which type of social engineering attack is being executed?

Which of the following is the BEST defense against tailgating attacks in a secure facility?

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Which TWO of the following are effective methods to prevent dumpster diving attacks? (Choose two.)

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?

A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?

Which TWO of the following are effective physical security controls to prevent tailgating?

Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?

Exhibit

An organization is implementing a social engineering defense program. Which TWO measures are most effective in reducing the risk of phishing attacks? (Choose two.)

Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?

Exhibit

Drag and drop the steps to perform a successful social engineering attack in a penetration test into the correct order.

Match each wireless attack to its description.

Track your progress over time

Start a Social Engineering and Physical Security only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions

Introduction to Ethical Hacking practice questions

Scanning Networks and Enumeration practice questions

Vulnerability Analysis and System Hacking practice questions

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Footprinting and Reconnaissance practice questions

Network and Web Application Attacks practice questions

Wireless, IoT and Cloud Security practice questions

Cryptography and Malware Analysis practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid