CIPA Social Engineering & Phishing Attacks 3

Question 1

What is 'tailgating' (also called piggybacking) in physical social engineering?

Accepted Answer

Gaining unauthorized physical access by following an authorized person through a secured entry

Answer

Following someone's online activity to gather personal information

Answer

Sending emails immediately after a victim clicks a phishing link

Answer

Tracking a target's vehicle using GPS to learn their patterns

Question 2

What is 'quid pro quo' as a social engineering tactic?

Accepted Answer

Offering a service or benefit in exchange for information or access

Answer

Threatening victims with legal action unless they provide personal data

Answer

Exchanging stolen personal data on dark web markets

Answer

Impersonating a government official to demand compliance

Question 3

What is 'typosquatting' and how is it used in identity theft?

Accepted Answer

Registering domain names with common misspellings of legitimate sites to capture traffic from victims who mistype URLs

Answer

Planting typos in phishing emails to evade spam filters

Answer

Using speech-to-text errors to compromise voice-activated devices

Answer

Exploiting autocorrect features on mobile devices to redirect victims

Question 4

How do attackers use Open Source Intelligence (OSINT) to enhance social engineering attacks?

Accepted Answer

By gathering publicly available personal information to craft convincing, personalized attacks

Answer

By purchasing stolen data from dark web forums

Answer

By hacking into government databases for personal records

Answer

By intercepting public Wi-Fi communications at cafes and airports

Question 5

Which of the following is the MOST effective way to verify the identity of a caller requesting sensitive information?

Accepted Answer

Hang up and call back using the official number from the organization's verified website

Answer

Ask the caller for their employee ID number

Answer

Ask the caller to confirm the last four digits of their Social Security Number

Answer

Request that the caller send a follow-up email before proceeding

Question 6

An attacker sends a text message claiming to be from your bank stating your account is frozen and asks you to click a link to verify your identity. This is an example of:

Accepted Answer

Smishing

Answer

Vishing

Answer

Pharming

Answer

Pretexting

Question 7

As a CIPA advisor, what should you recommend to a client who suspects they responded to a phishing email and may have disclosed login credentials?

Accepted Answer

Immediately change passwords, enable multi-factor authentication, and monitor all linked accounts for unauthorized activity

Answer

Wait 30 days to see if any fraudulent activity appears before taking action

Answer

Only report the incident to the FTC and take no other immediate steps

Answer

Delete the phishing email and clear browser history to remove any traces