Certified Ethical Hacker Social Engineering and Physical Security 3

Question 1

An attacker calls an employee pretending to be tech support and asks them to read out a one-time code just texted to them. This voice-based attack is called:

Accepted Answer

Vishing

Answer

Smishing

Answer

Tailgating

Answer

Watering hole

Question 2

What is 'shoulder surfing' in the context of physical security?

Accepted Answer

Observing a victim's screen or keypad to steal information

Answer

Riding behind an authorized person through a door

Answer

Searching trash for documents

Answer

Cloning an RFID badge

Question 3

A fraudulent SMS message claiming a package delivery failed and asking the user to click a link is an example of:

Accepted Answer

Smishing

Answer

Whaling

Answer

Pharming

Answer

Baiting

Question 4

Which physical control prevents an attacker from cloning a proximity badge by capturing its RFID signal from a distance?

Accepted Answer

Shielded badge holders (RFID-blocking sleeves)

Answer

Longer Wi-Fi keys

Answer

Disabling Bluetooth on phones

Answer

Brighter lobby lighting

Question 5

In a 'quid pro quo' social engineering attack, the attacker primarily offers:

Accepted Answer

A benefit or service in exchange for information or access

Answer

A threat of immediate legal action

Answer

A free physical USB device

Answer

Proof of widespread peer participation

Question 6

An attacker compromises a website frequently visited by employees of a target company to infect them. This technique is known as a:

Accepted Answer

Watering hole attack

Answer

Whaling attack

Answer

Dumpster dive

Answer

Mantrap bypass

Question 7

Which is the BEST first response if an employee suspects they fell for a phishing email and entered their credentials?

Accepted Answer

Immediately report it and change the affected password

Answer

Delete the email and say nothing

Answer

Forward the email to all colleagues

Answer

Reboot the computer and ignore it