eJPT Social Engineering Techniques 2

Question 1

An attacker calls a help desk posing as a new IT vendor and asks staff to reset a user's password 'for testing purposes.' What social engineering principle is primarily being exploited?

Accepted Answer

Authority

Answer

The attacker exploits authority by impersonating a vendor with perceived technical authority over IT systems.

Question 2

Which of the following best describes a 'watering hole' attack in the context of social engineering?

Accepted Answer

Compromising a website frequently visited by the target group

Answer

A watering hole attack compromises a website the target group regularly visits, so victims are infected when they browse it.

Question 3

During a penetration test, you discover that employees freely share internal org-chart details with strangers on LinkedIn. Which OSINT-based social engineering threat does this enable?

Accepted Answer

Spear phishing with personalized context

Answer

Org-chart data enables crafting highly personalized spear phishing emails that reference real names and roles.

Question 4

What is 'pretexting' in social engineering?

Accepted Answer

Creating a fabricated scenario to manipulate a target into revealing information

Answer

Pretexting involves inventing a believable scenario (pretext) to trick the victim into complying with a request.

Question 5

An attacker sends an SMS claiming the target's bank account is locked and provides a link to 'verify identity.' This is an example of:

Accepted Answer

Smishing

Answer

Smishing (SMS phishing) uses text messages to lure victims into revealing credentials or clicking malicious links.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Social Engineering Techniques 2