PenTest+ PenTest+ Social Engineering & Physical Security 2 — Questions and Answers
Question 1: What is 'whaling' in the context of phishing attacks?
- Mass phishing campaigns targeting large enterprises
- Highly targeted phishing aimed at senior executives and high-value individuals (Correct answer)
- Phishing attacks targeting maritime and fishing companies
- Phishing emails using whale-themed imagery as lures
Correct answer: Highly targeted phishing aimed at senior executives and high-value individuals
Whaling targets high-value individuals such as CEOs, CFOs, and board members with carefully crafted attacks to gain access to sensitive organizational data or funds.
Question 2: Which set of DNS records is critical for organizations to configure to defend against email spoofing used in phishing?
- A, AAAA, and CNAME records
- SPF, DKIM, and DMARC records (Correct answer)
- MX, PTR, and NS records
- SOA, TXT, and CAA records
Correct answer: SPF, DKIM, and DMARC records
SPF validates sending IP addresses, DKIM adds cryptographic signatures to emails, and DMARC enforces policy — together they significantly reduce domain spoofing in phishing.
Question 3: What is a 'watering hole' attack and why is it effective?
- A DoS attack that floods a network with traffic
- Compromising websites frequently visited by the target group to infect them with malware (Correct answer)
- A physical attack targeting water utility control systems
- A brute-force credential attack targeting authentication portals
Correct answer: Compromising websites frequently visited by the target group to infect them with malware
Watering hole attacks compromise websites the target group regularly visits, allowing attackers to passively infect victims when they browse a site they already trust.
Question 4: What is 'smishing' as a social engineering technique?
- Social media account impersonation attacks
- Phishing attacks delivered via SMS text messages (Correct answer)
- Physically smashing security devices to bypass controls
- Network-level packet manipulation and spoofing attacks
Correct answer: Phishing attacks delivered via SMS text messages
Smishing (SMS phishing) uses text messages to deceive targets into clicking malicious links or submitting sensitive information, leveraging the trust placed in mobile texts.
Question 5: What reconnaissance information is most valuable to gather before conducting a pretexting engagement?
- The organization's current stock price and market cap
- Employee names, job titles, internal terminology, and organizational structure (Correct answer)
- The company's current marketing and advertising strategy
- Physical details like building floor count and parking arrangements
Correct answer: Employee names, job titles, internal terminology, and organizational structure
Knowing employee names, roles, internal jargon, and org structure makes a pretext far more convincing by allowing the attacker to speak and act like a legitimate insider.
Question 6: Which metric best measures the success of a phishing simulation campaign during a pentest engagement?
- Total number of phishing emails sent
- Click-through rate and credential submission rate (Correct answer)
- Speed at which phishing emails were delivered
- Average size in kilobytes of the phishing emails
Correct answer: Click-through rate and credential submission rate
Click-through and credential submission rates directly measure how many targets were deceived, providing actionable data on organizational susceptibility to phishing.
PenTest+ PenTest+ Social Engineering & Physical Security 2
What is 'whaling' in the context of phishing attacks?