ALISON Social Engineering & Human Factor Security 1 — Questions and Answers
Question 1: Which social engineering attack involves sending fraudulent emails that appear to come from a trusted source to steal credentials?
- Vishing
- Phishing (Correct answer)
- Smishing
- Tailgating
Correct answer: Phishing
Phishing uses deceptive emails that mimic legitimate organizations to trick recipients into revealing sensitive information.
Question 2: What is 'pretexting' in the context of social engineering?
- Sending bulk spam emails
- Creating a fabricated scenario to manipulate a victim into revealing information (Correct answer)
- Installing keyloggers on a target system
- Intercepting wireless network traffic
Correct answer: Creating a fabricated scenario to manipulate a victim into revealing information
Pretexting involves an attacker inventing a false situation or identity to gain the victim's trust and extract confidential information.
Question 3: Which attack technique involves following an authorized person through a secured door without using credentials?
- Shoulder surfing
- Dumpster diving
- Tailgating (Correct answer)
- Baiting
Correct answer: Tailgating
Tailgating (or piggybacking) is a physical security attack where an unauthorized person follows an authorized individual into a restricted area.
Question 4: What is the primary goal of security awareness training in an organization?
- To install antivirus software
- To teach employees to recognize and respond to social engineering attacks (Correct answer)
- To configure firewalls and IDS systems
- To perform penetration testing on systems
Correct answer: To teach employees to recognize and respond to social engineering attacks
Security awareness training educates employees on identifying threats like phishing, pretexting, and other manipulation tactics.
Question 5: Which principle of influence do attackers exploit when they create a sense of urgency in phishing emails?
- Social proof
- Reciprocity
- Scarcity (Correct answer)
- Authority
Correct answer: Scarcity
Scarcity and urgency pressure victims into acting quickly without thinking critically, a common manipulation tactic in social engineering.
Question 6: What is 'vishing' in social engineering?
- Visual phishing using fake websites
- Voice-based phishing conducted over phone calls (Correct answer)
- Video-based spear phishing attacks
- Phishing via SMS text messages
Correct answer: Voice-based phishing conducted over phone calls
Vishing (voice phishing) uses phone calls where attackers impersonate trusted entities like banks or government agencies to obtain sensitive data.
ALISON Social Engineering & Human Factor Security 1
Which social engineering attack involves sending fraudulent emails that appear to come from a trusted source to steal credentials?