CVA CVA Social Engineering & Physical Security Testing 2

Question 1

Which type of phishing attack specifically targets high-level executives or senior management?

Accepted Answer

Whaling

Answer

Whaling targets C-suite executives and senior leaders with highly tailored phishing attacks, recognizing that they have access to the most sensitive data and authorization capabilities.

Question 2

During a physical security assessment, what is the purpose of testing RFID badge cloning?

Accepted Answer

To determine if access control cards can be duplicated to enable unauthorized physical access

Answer

RFID badge cloning tests whether access control cards (especially older 125kHz HID cards) can be duplicated using commercially available readers, enabling unauthorized facility access.

Question 3

What is the goal of a 'pretexting call' to an organization's help desk during a social engineering assessment?

Accepted Answer

To determine if help desk staff can be manipulated into resetting credentials or providing access without proper identity verification

Answer

Help desk pretexting tests whether support staff will bypass identity verification procedures when presented with a convincing false scenario, potentially resetting credentials for an attacker.

Question 4

Which physical security control is specifically designed to prevent tailgating by allowing only one person to enter per authentication event?

Accepted Answer

Mantrap (airlock)

Answer

A mantrap (airlock) uses two interlocking doors where only one can open at a time, ensuring that only the authenticated individual can enter the secured area.

Question 5

What is 'open-source intelligence (OSINT)' and how is it used in social engineering assessments?

Accepted Answer

Gathering publicly available information about targets from social media, websites, and public records to craft convincing attacks

Answer

OSINT collection from LinkedIn, social media, company websites, and public records provides attackers with information to craft highly convincing and personalized social engineering attacks.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Social Engineering & Physical Security Testing 2