CIPA Social Engineering & Phishing Attacks 2

Question 1

What is 'baiting' in social engineering attacks?

Accepted Answer

Leaving infected physical media such as USB drives where targets will find and use them

Answer

Sending enticing emails offering prizes to lure victims into clicking links

Answer

Using attractive website designs to increase phishing click rates

Answer

Posting fake job offers on social media to harvest resumes

Question 2

What is a 'watering hole' attack?

Accepted Answer

Compromising a website frequently visited by a target group to infect their systems

Answer

Sending phishing emails to employees near water coolers in offices

Answer

Flooding a victim's inbox with fraudulent emails

Answer

Intercepting data transmitted over public Wi-Fi hotspots

Question 3

What is 'whaling' in social engineering and phishing?

Accepted Answer

Targeted phishing attacks directed at high-level executives or decision-makers

Answer

Phishing attacks that cast a very wide net to catch as many victims as possible

Answer

Large-scale data breaches affecting thousands of users at once

Answer

Social engineering attacks conducted through whale-watching forums

Question 4

What is 'clone phishing'?

Accepted Answer

Creating a near-identical copy of a legitimate email with malicious links replacing the originals

Answer

Creating fake duplicate social media profiles to steal identity data

Answer

Replicating the victim's own past emails to trick them into responding

Answer

Copying entire websites and hosting them on lookalike domains

Question 5

What psychological principle do social engineers MOST commonly exploit to gain compliance?

Accepted Answer

Authority and urgency

Answer

Confirmation bias

Answer

Cognitive dissonance

Answer

The bystander effect

Question 6

How does Business Email Compromise (BEC) typically leverage social engineering?

Accepted Answer

By impersonating executives or vendors via spoofed emails to authorize fraudulent wire transfers

Answer

By installing keyloggers on corporate email servers

Answer

By mass-phishing all employees with malware attachments

Answer

By hacking into corporate email accounts using brute force

Question 7

What is the BEST immediate defense an organization should implement against social engineering attacks?

Accepted Answer

Conducting regular employee security awareness training

Answer

Installing the latest antivirus software on all devices

Answer

Using multi-factor authentication on all accounts

Answer

Encrypting all email communications