CVA Social Engineering & Physical Security Testing Flashcards

Which social engineering technique involves impersonating a trusted authority figure via phone to extract sensitive information from an employee?

Answer: Vishing

Vishing (voice phishing) uses phone calls where attackers impersonate IT support, executives, or other authorities to manipulate employees into revealing credentials or sensitive data.

During a physical security assessment, what is 'tailgating' (piggybacking)?

Answer: Following an authorized person through a secured access-controlled door without using credentials

Tailgating occurs when an unauthorized individual follows closely behind an authorized person to gain physical access to a restricted area without using their own credentials.

What is 'pretexting' in the context of social engineering assessments?

Answer: Creating a fabricated scenario or false identity to manipulate a target into providing information or access

Pretexting involves crafting a believable false scenario or identity (e.g., IT auditor, delivery person) to gain the target's trust and extract sensitive information or physical access.

Which attack involves sending fraudulent text messages to trick recipients into clicking malicious links or providing sensitive information?

Answer: Smishing

Smishing (SMS phishing) uses text messages to deliver malicious links or pretexts designed to steal credentials, install malware, or extract sensitive information.

During a physical security assessment, what does 'dumpster diving' evaluate?

Answer: Whether sensitive information is discarded in an accessible manner without proper destruction

Dumpster diving assesses whether an organization properly destroys sensitive documents and media before disposal, as improperly discarded information can aid attackers.

What is 'baiting' in a social engineering context?

Answer: Leaving infected physical media (USB drives) in locations where employees may find and use them

Baiting uses infected physical media like USB drives left in parking lots or common areas to tempt employees into plugging them into corporate systems.