PenTest+ PenTest+ Social Engineering & Physical Security

Question 1

Which social engineering technique involves creating a fabricated scenario to manipulate a target into divulging sensitive information?

Accepted Answer

Pretexting

Answer

Pretexting involves inventing a believable fictional scenario (pretext) to manipulate targets into providing sensitive information or taking desired actions.

Question 2

What is 'vishing' as a social engineering attack vector?

Accepted Answer

Voice phishing conducted over telephone calls to impersonate trusted entities

Answer

Vishing uses telephone calls where attackers impersonate banks, IT support, or government agencies to trick targets into revealing credentials or sensitive data.

Question 3

What is 'spear phishing' and how does it differ from standard phishing?

Accepted Answer

Targeted phishing customized with personal details about a specific individual or organization

Answer

Spear phishing uses personalized information about the victim (name, role, colleagues) to craft highly convincing, targeted deceptive messages unlike mass phishing blasts.

Question 4

Which tool is specifically designed for conducting social engineering campaigns and phishing simulations during pentests?

Accepted Answer

Social-Engineer Toolkit (SET)

Answer

The Social-Engineer Toolkit (SET) is an open-source framework built specifically for social engineering attacks including phishing, credential harvesting, and payload delivery.

Question 5

Which social engineering influence principle exploits a target's sense of obligation after receiving something of value?

Accepted Answer

Reciprocity

Answer

Reciprocity exploits the human tendency to feel obligated to return a favor, where attackers offer something (fake IT help, gifts) to elicit sensitive information in return.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ PenTest+ Social Engineering & Physical Security