CEH Practice Question: Malware, Social Engineering and Network Attacks

Which TWO of the following are examples of social engineering attacks? (Select two)

⚠ Common exam trap

Candidates often confuse pharming (a technical redirection attack) with social engineering, but pharming does not involve direct human interaction or psychological manipulation, which is the defining characteristic of social engineering attacks.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Pretexting

Pretexting (B) is a social engineering attack because the attacker fabricates a believable scenario or false identity (a 'pretext') to manipulate a human target into divulging information or performing an action, exploiting trust rather than technical flaws. Vishing (E) is also social engineering, as it uses voice communication—typically a phone call or VoIP—to impersonate a trusted party and trick the victim into revealing credentials, payment data, or other sensitive information. The remaining options are technical attacks, not social engineering: pharming (A) redirects users to fraudulent websites via DNS poisoning or host file modification, SYN flood (C) is a network-layer denial-of-service attack abusing the TCP three-way handshake, and brute force (D) is a cryptographic or authentication attack that systematically tries keys or passwords.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Pharming
Why it's wrong here
Pharming redirects users to fraudulent sites through DNS poisoning or hosts-file manipulation, which is a technical attack requiring no human persuasion. It is tempting because it mimics phishing's fake-site outcome, but phishing manipulates the victim's trust, whereas pharming subverts name resolution.
✓
Pretexting
Why this is correct
Pretexting is a social engineering attack where the attacker invents a fabricated scenario, often impersonating a trusted figure, to manipulate a victim into divulging information or performing actions. It relies on psychological manipulation rather than technical exploits, satisfying the question's requirement for a social engineering example.
✗
SYN flood
Why it's wrong here
A SYN flood is a network-layer denial-of-service technique that exhausts a server's TCP half-open connection table; it manipulates protocol handshakes, not human trust. It is tempting because both categories involve attackers exploiting a weakness, but SYN floods would be the correct answer to a question asking for network-based attacks rather than social engineering.
✗
Brute force attack
Why it's wrong here
Brute force is a computational attack that systematically tries password combinations against an authentication service; it bypasses people entirely rather than manipulating them. It is tempting because weak credentials often stem from poor user habits, but brute force would be the correct answer to a question asking for password-cracking or authentication attacks, not social engineering.
✓
Vishing
Why this is correct
Vishing is voice phishing: social engineering conducted over telephone calls, where attackers impersonate legitimate entities to extract credentials or sensitive data. It exploits human trust through verbal deception, not software vulnerabilities, making it a recognised social engineering attack type alongside phishing and pretexting.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question