Security Plus - Chapter 4

Question 1

Social Engineering

Answer 1

The practice of manipulating people through a variety of strategies to accomplish desired actions. Influencing users to take actions they may not have taken without coercion.

Question 2

Authority Principle

Answer 2

A social engineering principle that relies on the fact an individual will obey someone who appears to be in charge or knowledgeable and coerces a person to perform a requested action.

Question 3

Intimidation Principle

Answer 3

A social engineering principle that relies on scaring or bullying an individual into taking a desired action.

Question 4

Consensus-Based Principle

Answer 4

A social engineering principle that coerce people to want to do what others are doing and persuade them to take an action. Also known as social proof. Others are doing it, so you should too.

Question 5

Scarcity Principle

Answer 5

A social engineering principle that make something look more desirable because others are not provided this option or there is limited available.

Question 6

Familiarity-Based Principle

Answer 6

A social engineering principle that relies on you liking the individual or even the organization the individual claims to represent.

Question 7

Trust Principle

Answer 7

A social engineering principle that relies on a connection with the individual they are targeting. They work to build a connection with the individual until they are ready to get the person to perform an action.

Question 8

Urgency Principle

Answer 8

A social engineering principle that creates a feeling that an action must be taken quickly due to some reason.

Question 9

Phishing

Answer 9

A social engineering technique that describes the fraudulent acquisition of information, often focused on credentials like usernames and passwords, as well as sensitive personal information like credit card numbers and related data.

Question 10

Vishing

Answer 10

A social engineering technique via voice or voicemail messages. Phone calls to targets that get a person to disclose information like their username and password to an attacker pretending to be a support personnel.

Question 11

Smishing

Answer 11

Social engineering technique that uses text messages to attempt to gain private information about the target.

Question 12

Misinformation and Disinformation

Answer 12

A social engineering technique that overloads social media, email, and other online media platforms to push information to users with an agenda that the attacker is trying to pursue.

Question 13

TRUST Process

Answer 13

To combat misinformation and disinformation, CISA recommends to use the 5 step TRUST process to determine what is correct information.
1. Tell your story
2. Ready your team
3. Understand and assess MDM
4. Strategize a response
5. Track the outcomes

Question 14

CISA Recommendations for Preparedness

Answer 14

1. Assessing the information environment.
2. Identifying any vulnerabilities
3. Fortifying communication channels
4. Engaging in proactive communication
5. Developing an incident response plan

Question 15

Impersonation

Answer 15

A social engineering technique where the attacker is pretending to be someone else.

Question 16

Identity Fraud

Answer 16

The use of someone else’s identity for malicious purpose.

Question 17

Business Email Compromise

Answer 17

A social engineering technique using apparently legitimate email addresses to conduct scams and other attacks.

Question 18

Pretexting

Answer 18

A social engineering technique using made-up scenarios to justify why you are requesting information from an individual. Thwarted using verification requirements or validation.

Question 19

Watering Hole Attacks

Answer 19

A social engineering technique using websites that targets frequent and convince those users to provide information from the site. Compromising an ad on the site and embedding malware in the advertisement.

Question 20

Brand Impersonation

Answer 20

A social engineering technique that uses emails from a legitimate brand or a website that mimics a legitimate website and embeds phishing links in those emails or sites that targets click on and provide personal information.

Question 21

Typosquatting

Answer 21

A social engineering technique that uses mistyped web URL’s and driving traffic to their illegitimate sites to drive sales of their similar products.

Question 22

Brute Force Attack

Answer 22

A password attack that the attacker iterates through passwords until they find one that allows access.

Question 23

Password Spraying Attack

Answer 23

A password attack that uses a small number of passwords but attempts access to a large number of accounts.

Question 24

Dictionary Attack

Answer 24

A password attack that uses a list of words and iterates those words attempting to access.

Question 25

Hash

Answer 25

A one-way cryptographic function that takes an input and generates a unique and repeatable output from that input.