Core 2: Social Engineering

Question 1

An unauthorized practice of obtaining confidential information by manipulating people into disclosing sensitive data is referred to as:

Shoulder surfing
Privilege escalation
Social engineering
Penetration testing

Answer 1

Social engineering

Question 2

A fraudulent email requesting its recipient to reveal sensitive information (e.g. username and password) used later by an attacker for the purpose of identity theft is an example of: (Select 2 answers)

 Phishing
 Watering hole attack
 Social engineering
 Bluejacking
 Vishing

Answer 2

Phishing

Social engineering

Question 3

A social engineering technique whereby attackers under disguise of a legitimate request attempt to gain access to confidential information they shouldn’t have access to is commonly referred to as:

Phishing
Privilege escalation
Backdoor access
Shoulder surfing

Answer 3

Phishing

Question 4

Phishing scams targeting a specific group of people are referred to as:

Vishing
Spear phishing
Spoofing
Whaling

Answer 4

Spear phishing

Question 5

Phishing scams targeting people holding high positions in an organization or business are known as:

 Vishing
 Bluesnarfing
 Whaling
 Bluejacking
 Pharming

Answer 5

Whaling

Question 6

Which social engineering attack relies on identity theft?

Tailgating
Dumpster diving
Impersonation
Watering hole attack

Answer 6

Impersonation

Question 7

A situation in which an unauthorized person can view someone’s display or keyboard to learn their password or other confidential information is referred to as:

Spear phishing
Tailgating
Shoulder surfing
Spoofing

Answer 7

Shoulder surfing

Question 8

What is tailgating?

Acquiring unauthorized access to confidential data

Looking over someone’s shoulder to get information

Gaining unauthorized access to restricted areas by following another person

Manipulating a user into disclosing confidential information

Answer 8

Gaining unauthorized access to restricted areas by following another person

Question 9

In computer security, the term “Dumpster diving” is used to describe a practice of sifting through trash for discarded documents containing sensitive data. Found documents containing names and surnames of the employees along with the information about positions held in the company and other data can be used to facilitate social engineering attacks. Having the documents shredded or incinerated before disposal makes dumpster diving less effective and mitigates the risk of social engineering attacks.

True
False

Answer 9

True