PenTest+ Social Engineering & Physical Security Flashcards

What is 'whaling' in the context of phishing attacks?

Answer: Highly targeted phishing aimed at senior executives and high-value individuals

Whaling targets high-value individuals such as CEOs, CFOs, and board members with carefully crafted attacks to gain access to sensitive organizational data or funds.

Which set of DNS records is critical for organizations to configure to defend against email spoofing used in phishing?

Answer: SPF, DKIM, and DMARC records

SPF validates sending IP addresses, DKIM adds cryptographic signatures to emails, and DMARC enforces policy — together they significantly reduce domain spoofing in phishing.

What is a 'watering hole' attack and why is it effective?

Answer: Compromising websites frequently visited by the target group to infect them with malware

Watering hole attacks compromise websites the target group regularly visits, allowing attackers to passively infect victims when they browse a site they already trust.

What is 'smishing' as a social engineering technique?

Answer: Phishing attacks delivered via SMS text messages

Smishing (SMS phishing) uses text messages to deceive targets into clicking malicious links or submitting sensitive information, leveraging the trust placed in mobile texts.

What reconnaissance information is most valuable to gather before conducting a pretexting engagement?

Answer: Employee names, job titles, internal terminology, and organizational structure

Knowing employee names, roles, internal jargon, and org structure makes a pretext far more convincing by allowing the attacker to speak and act like a legitimate insider.

Which metric best measures the success of a phishing simulation campaign during a pentest engagement?

Answer: Click-through rate and credential submission rate

Click-through and credential submission rates directly measure how many targets were deceived, providing actionable data on organizational susceptibility to phishing.