CIPA Social Engineering & Phishing Attacks 3

Question 1

What is 'tailgating' (also called piggybacking) in physical social engineering?

Accepted Answer

Gaining unauthorized physical access by following an authorized person through a secured entry

Answer

Tailgating involves a social engineer following closely behind an authorized employee through a secured door before it closes, exploiting politeness norms to bypass physical security controls.

Question 2

What is 'quid pro quo' as a social engineering tactic?

Accepted Answer

Offering a service or benefit in exchange for information or access

Answer

Quid pro quo attacks offer something of perceived value (e.g., free tech support) in return for credentials or access, exploiting the human tendency toward reciprocity.

Question 3

What is 'typosquatting' and how is it used in identity theft?

Accepted Answer

Registering domain names with common misspellings of legitimate sites to capture traffic from victims who mistype URLs

Answer

Typosquatting (URL hijacking) registers domains like 'paypa1.com' or 'amazzon.com' to capture users who make small typing errors, leading them to fraudulent lookalike sites that steal credentials or install malware.

Question 4

How do attackers use Open Source Intelligence (OSINT) to enhance social engineering attacks?

Accepted Answer

By gathering publicly available personal information to craft convincing, personalized attacks

Answer

OSINT uses freely available public data from social media, professional networks, public records, and online forums to personalize attacks, making them far more convincing to the target.

Question 5

Which of the following is the MOST effective way to verify the identity of a caller requesting sensitive information?

Accepted Answer

Hang up and call back using the official number from the organization's verified website

Answer

Hanging up and calling back using an independently verified official number ensures you are speaking with a legitimate representative and not an attacker who may have spoofed the caller ID.

(CIPA) Certified Identity Protection Advisor Practice Test

(CIPA) Certified Identity Protection Advisor Practice Test

CIPA Social Engineering & Phishing Attacks 3