Social Engineering and Physical Security Flashcards
7 cards from real Certified Ethical Hacker practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Social Engineering and Physical Security flashcards as text
An attacker carries a large box and asks an employee to 'hold the door' to a secured area, bypassing badge access. This is an example of:
Answer: Piggybacking/tailgating with a pretext
Carrying items to elicit help is a common social engineering pretext to gain unauthorized physical entry.
Which type of fence height is generally recommended to deter a determined intruder in physical security planning?
Answer: 8 feet or higher, often with razor wire
Fences of 8 feet or more, topped with razor wire, are recommended to deter determined intruders.
What is the primary security purpose of a 'clean desk policy'?
Answer: Prevent sensitive documents and credentials from being exposed or stolen
A clean desk policy reduces the risk of confidential information being viewed, photographed, or removed.
An attacker sets up a fake but legitimate-looking login portal that mirrors a company's SSO page to harvest credentials. This is BEST described as:
Answer: A credential harvesting/phishing site
A cloned login portal is used to capture (harvest) credentials entered by deceived users.
Which control type is a CCTV camera primarily considered in physical security?
Answer: Detective (and deterrent) control
CCTV detects and records activity and can deter intruders, making it a detective and deterrent control.
A 'reverse social engineering' attack typically involves the attacker:
Answer: Creating a problem, then offering to be the 'helper' the victim seeks out
In reverse social engineering, the attacker engineers a situation so the victim voluntarily requests their help.
Which of the following BEST mitigates risk from lost or stolen laptops containing sensitive data?
Answer: Full-disk encryption
Full-disk encryption renders data unreadable to anyone without the proper credentials if the device is stolen.