4A: Exploit the Human Psyche

Question 1

A social engineering tactic where a team will communicate, whether directly or indirectly, a lie or half-truth in order to get someone to believe a falsehood.

Answer 1

Pretexting

Question 2

Acquiring data from a target in order to launch an attack.

Answer 2

Elicitation

Question 3

An impersonation attack in which the attacker gains control of an employee’s account and uses it to convince other employees to perform fraudulent actions.

Answer 3

Business Email Compromise (BEC)

Question 4

A malicious communication that tricks the user into performing undesired actions, such as deleting important system files in an attempt to remove a virus, or sending money or important information.

Answer 4

Hoax

Question 5

Email-based social engineering attack in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.

Answer 5

Phishing

Question 6

A set of tools included in Kali Linux. This tool has built-in features to help you launch a phishing campaign, create a malicious payload, such as a virus, worm, or Trojan, and embed the payload in a PDF.

Answer 6

Social Engineers Toolkit (SET)

Question 7

An impersonation attack in which a request for a website, typically an e-commerce site, is redirected to a similar-looking, but fake, website.

Answer 7

Pharming

Question 8

A form of social engineering in which an attacker leaves infected physical media in an area where a victim finds it and then inserts it into a computer.

Answer 8

Baiting

Question 9

An email-based or web-based form of phishing which targets specific individuals.

Answer 9

Spear Phishing

Question 10

An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

Answer 10

Watering Hole Attack

Question 11

An attack that targets the end-to-end process of manufacturing, distributing, and handling goods and services.

Answer 11

Supply Chain Attack

Question 12

Occurs when malware on a target organization harms an associated (downstream) vendor. At that point the target organization is liable for any damage.

Answer 12

Downstream Liability

Question 13

An attack—also called typosquatting—in which an attacker registers a domain name with a common misspelling of an existing domain, so that a user who misspells a URL they enter into a browser is taken to the attacker’s website.

Answer 13

URL Hijacking

Question 14

Social engineering attack where an attacker pretends to be someone they are not.

Answer 14

Impersonation