Ethical Hacking 10

Question 1

Which method of preventing an insider threat are the completion of tasks allotted to different employees at different times?

Answer 1

Rotation of duties

Question 2

In which social engineering technique does an unauthorized person convince an authorized person to allow him or her into a secured area?

Answer 2

Piggybacking

Question 3

Which of the following statements is NOT true regarding effective measures to defend against social engineering attacks?

Answer 3

A good security policy can prevent people from being socially engineered.

Question 4

What software will provide some protection against well known phishing websites?

Answer 4

Netcraft toolbar

Question 5

What statement represents an effective means of countering a persuasion based social engineering attack?

Answer 5

Employees should be trained on the basic security policies and procedures of the organization.

Question 6

When an attacker sends an e-mail or provides a link falsely claiming to be from a legitimate site in an attempt to acquire a user’s personal or account information, the attacker is using which feature or technique?

Answer 6

Phishing

Question 7

You are attempting to gather information about a client’s network, and are surveying a company site. Access is gained via secured entry using ID cards. You observe several employees on a smoke break near once of the secured entrances. Once they are finished, you casually follow them in after they’ve unlocked the entry point with an ID card. What type of social engineering attack has occurred?

Answer 7

tailgating

Question 8

Which of the following is a technique in which an attacker sends an e-mail or provides a link falsely claiming to be from a legitimate site in an attempt to acquire a user’s personal or account information?

Answer 8

Phishing

Question 9

What kind of social engineering attack involves an unauthorized person who convinced an authorized person to allow him or her into secured areas?

Answer 9

piggybacking attack

Question 10

What type of social engineering involves the behavioral trait that compels someone to do what everyone else is doing?

Answer 10

social validation

Question 11

Which type of social engineering threat is accomplished through the use of intimidation, persuasion, ingratiation, or assistance?

Answer 11

Personal Approaches

Question 12

Which of the following is NOT one of the four phases of the social engineering lifecycle?

Answer 12

Social validation

Question 13

What term is given to the authorization assigned to users or groups of users for their ability to read and write computer data and devices?

Answer 13

Access privileges

Question 14

What information could be used to steal a target’s identity once identified?

Answer 14

an telephone bill

a water bill

Question 15

Which type of attack uses the phone system?

Answer 15

phreaking

Question 16

whiced legitimate, but in reality, was designed to appear exactly like your company’s corporate Internet login page. What type of attack is this?

Answer 16

phishing

Question 17

What is the first phase of the social engineering cycle?

Answer 17

information gathering

Question 18

A client is developing a security policy for their network and has asked you how they should defend against intimidation attacks. What response provides the best approach to this kind of specific attack?

Answer 18

The policy should outline how employees will escalate intimidation attempts to higher management.

Question 19

Which human-based social engineering technique involves an attacker masquerading as a hardware vendor?

Answer 19

Posing as Technical Support

Question 20

Which of the following should NOT be included in an effective password policy?

Answer 20

At least one other person should know a user’s password

Question 21

What are the costs for a business when a user is tricked into downloading malware?

Answer 21

Business credibility, Business availability

Question 22

Measures that must be taken to prevent the misuse of sensitive data would be part of which social engineering counter measure?

Answer 22

Operational Guidelines

Question 23

What social engineering technique includes interception of any form of communication, including audio, video, or written?

Answer 23

Eavesdropping