Social Engineering and Physical Security Flashcards
7 cards from real Certified Ethical Hacker practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Social Engineering and Physical Security flashcards as text
An attacker impersonates a delivery courier to gain access to a building's loading dock and then wanders into restricted areas. This highlights the importance of:
Answer: Visitor escort and access zoning policies
Visitor escorting and zoned access prevent outsiders from freely moving into restricted areas.
What is the main risk of 'pretexting' over the phone to a help desk?
Answer: The help desk may reset credentials or disclose info to an impostor
Without proper identity verification, help desks can be tricked into resetting passwords or leaking data.
Which technique uses an authoritative-looking but malicious phone charging station or cable to compromise mobile devices in public?
Answer: Juice jacking
Juice jacking uses compromised charging ports or cables to steal data or install malware on connected devices.
A security guard who verifies badges, signs in visitors, and watches monitors is an example of which control category?
Answer: Administrative/physical control performed by personnel
Human guards enforce physical and procedural controls and can respond dynamically to threats.
Which of these is the strongest authentication factor to add to badge access for high-security areas?
Answer: Biometric verification (multi-factor)
Combining a badge with biometrics adds a second factor that is hard to clone or share.
An attacker observes employees' daily routines, badge styles, and entry times before attempting an intrusion. This preparatory phase is called:
Answer: Reconnaissance/surveillance
Reconnaissance gathers details about targets and routines to plan a more convincing physical or social attack.
Which response BEST reduces the impact of a successful social engineering breach once detected?
Answer: Incident response activation and credential revocation
Activating incident response and revoking compromised credentials quickly contains and limits the damage.