PenTest+ PenTest+ Social Engineering & Physical Security 2

Question 1

What is 'whaling' in the context of phishing attacks?

Accepted Answer

Highly targeted phishing aimed at senior executives and high-value individuals

Answer

Whaling targets high-value individuals such as CEOs, CFOs, and board members with carefully crafted attacks to gain access to sensitive organizational data or funds.

Question 2

Which set of DNS records is critical for organizations to configure to defend against email spoofing used in phishing?

Accepted Answer

SPF, DKIM, and DMARC records

Answer

SPF validates sending IP addresses, DKIM adds cryptographic signatures to emails, and DMARC enforces policy — together they significantly reduce domain spoofing in phishing.

Question 3

What is a 'watering hole' attack and why is it effective?

Accepted Answer

Compromising websites frequently visited by the target group to infect them with malware

Answer

Watering hole attacks compromise websites the target group regularly visits, allowing attackers to passively infect victims when they browse a site they already trust.

Question 4

What is 'smishing' as a social engineering technique?

Accepted Answer

Phishing attacks delivered via SMS text messages

Answer

Smishing (SMS phishing) uses text messages to deceive targets into clicking malicious links or submitting sensitive information, leveraging the trust placed in mobile texts.

Question 5

What reconnaissance information is most valuable to gather before conducting a pretexting engagement?

Accepted Answer

Employee names, job titles, internal terminology, and organizational structure

Answer

Knowing employee names, roles, internal jargon, and org structure makes a pretext far more convincing by allowing the attacker to speak and act like a legitimate insider.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ PenTest+ Social Engineering & Physical Security 2