Certified Ethical Hacker Social Engineering and Physical Security 2 — Questions and Answers
Question 1: An attacker sends an email claiming to be from the IT helpdesk, urgently requesting the user reset their password via an included link. Which social engineering principle is MOST being exploited?
- Authority and urgency (Correct answer)
- Reciprocity
- Social proof
- Scarcity of resources
Correct answer: Authority and urgency
Impersonating IT (authority) plus an urgent deadline pressures the victim into acting without verifying.
Question 2: What is the term for digging through an organization's trash to recover sensitive documents, sticky notes, or discarded media?
- Dumpster diving (Correct answer)
- Shoulder surfing
- Tailgating
- Pretexting
Correct answer: Dumpster diving
Dumpster diving recovers improperly discarded information that may contain credentials or internal data.
Question 3: An attacker drops several USB flash drives labeled 'Salaries 2026' in a company parking lot hoping employees plug them in. This attack is called:
- Baiting (Correct answer)
- Vishing
- Whaling
- Quid pro quo
Correct answer: Baiting
Baiting lures victims with an enticing physical or digital item that delivers malware when used.
Question 4: Which countermeasure is MOST effective against tailgating into a secure facility?
- Mantraps with anti-passback controls (Correct answer)
- Stronger Wi-Fi passwords
- Email spam filters
- Endpoint antivirus
Correct answer: Mantraps with anti-passback controls
A mantrap allows only one authenticated person through at a time, preventing an unauthorized follower.
Question 5: A phishing attack specifically targeting a company's CEO or other high-value executives is known as:
- Whaling (Correct answer)
- Smishing
- Pharming
- Spear phishing of interns
Correct answer: Whaling
Whaling is spear phishing aimed at senior executives or 'big fish' for high-impact access.
Question 6: During a pretexting call, an attacker pretends to be a vendor needing to 'verify' an account before processing a refund. What is the attacker primarily relying on?
- A fabricated scenario to build trust (Correct answer)
- A zero-day exploit
- A brute-force tool
- An SQL injection payload
Correct answer: A fabricated scenario to build trust
Pretexting uses an invented but believable backstory to manipulate the target into disclosing information.
Question 7: Which security awareness practice BEST reduces the success rate of social engineering attacks over time?
- Regular phishing simulations and training (Correct answer)
- Disabling all USB ports permanently
- Increasing monitor brightness
- Rotating office furniture
Correct answer: Regular phishing simulations and training
Ongoing simulated phishing and training condition employees to recognize and report manipulation attempts.
Certified Ethical Hacker Social Engineering and Physical Security 2
An attacker sends an email claiming to be from the IT helpdesk, urgently requesting the user reset their password via an included link.
Which social engineering principle is MOST being exploited?