A+ Social Engineering Attack Vectors and Defenses Quiz

A clean desk policy requires employees to secure sensitive documents, notes, and devices whenever they leave their workspace, often by locking them away at the end of the day. This prevents visitors, cleaners, or intruders from reading or taking confidential information left in plain view, including passwords on sticky notes. Aesthetics and furniture are unrelated.

Encryption is a security control that protects data by making it unreadable without the correct key, so it is not a social engineering tactic. Phishing uses deceptive messages, pretexting uses a fabricated scenario to gain trust, and baiting uses tempting items like infected USB drives, all of which manipulate people rather than technology.

An identity verification policy requires employees to confirm who someone is before granting access to facilities or sharing information, for example by checking a badge, escorting visitors, or using callback verification. It counters impersonation and pretexting by removing the assumption that someone is legitimate just because they look or sound the part.

Security awareness training teaches employees to recognize social engineering tactics such as phishing, pretexting, and tailgating, and to report suspicious activity quickly. Since these attacks target people rather than systems, trained users become an active line of defense. Training cannot eliminate every threat or replace technical controls, and it is not a productivity monitoring tool.

The statement is true. Spear phishing targets a specific person, group, or organization with messages tailored using researched details such as names, job titles, and current projects. This personalization makes the messages far more convincing than generic phishing emails. When the target is a senior executive, the attack is called whaling.

Badge readers and access control systems restrict entry to secure areas to people with valid credentials and log who entered and when. They are physical security controls. Email encryption protects message contents, software firewalls filter network traffic, and antivirus detects malware, so none of them stop someone from walking into a restricted room.

Impersonation is when an attacker pretends to be a trusted person or organization, such as a manager, vendor, or help desk technician, to gain access or information they would otherwise be denied. It can happen in person, by phone, or by email, and it underpins many other social engineering techniques, including pretexting and phishing.

When an email requests sensitive information, verify the sender through a separate channel, such as calling a known phone number, because email addresses and signatures are easy to spoof. Responding immediately plays into the urgency attackers create, forwarding to colleagues spreads the risk, and sending partial information can still give attackers enough to use.

Credential harvesting is the collection of usernames and passwords by deception, most commonly through fake login pages that imitate trusted sites and capture whatever users type. Backing up accounts, storing encrypted credentials in a password manager, and implementing single sign-on are all legitimate administrative or security practices, not attacks designed to steal login information.

Vishing, short for voice phishing, uses phone calls or voicemail to trick victims into revealing information. Attackers often pose as banks, government agencies, or IT support and may spoof caller ID to appear legitimate. The urgency and personal interaction of a live call can make vishing more persuasive than a phishing email.

Social engineering targets people rather than technology, using manipulation, deception, and trust to trick them into revealing confidential information or taking actions that weaken security, such as sharing passwords or opening malicious attachments. Technical exploits, malware installation, and encryption are separate topics, though social engineering is often the first step that enables those technical attacks.

The statement is true. In reverse social engineering, the attacker often creates a problem, such as a fake network issue, then advertises themselves as the expert who can fix it. Because the victim reaches out for help, they trust the attacker more readily and willingly share credentials or access while the problem is being solved.

Callback verification means ending the request and contacting the person back through a known, trusted phone number or channel, rather than one they supplied, to confirm their identity. This defeats attackers who impersonate executives or vendors. Encryption protects data, firewalls filter network traffic, and antivirus detects malware, but none of them verify a requester’s identity.

Reconnaissance is the information-gathering phase an attacker completes before contacting a target, collecting details such as names, job roles, and contacts from social media, company websites, and other public sources. These details make a later pretext or phishing message more convincing. Dumpster diving is one possible reconnaissance method, specifically searching discarded materials for useful information.

Effective phishing defense uses several layers. Security awareness training helps users recognize suspicious messages, email filtering and spam detection block many phishing emails before they reach inboxes, and multi-factor authentication stops attackers from using stolen passwords alone. No single control is enough, so combining all three gives the strongest protection.

The statement is true. In a quid pro quo attack, the attacker offers a benefit, such as free technical support, a gift card, or a prize, in exchange for information or access. A common example is a caller posing as IT who offers to fix a problem if the user provides their login credentials.

Baiting relies on curiosity. An attacker leaves infected USB drives or other media where people will find them, hoping someone plugs one into a work computer. Once connected, the device can run malware that gives the attacker access or steals data. The defense is never connecting unknown media and reporting found devices to IT.

Tailgating occurs when an unauthorized person follows an authorized employee through a secure door before it closes, gaining entry without using their own badge or credentials. It exploits politeness, since people often hold doors open. Defenses include access control vestibules, security guards, and training employees not to let others enter behind them.

The caller invents a believable identity and scenario, posing as IT support, to convince the employee to hand over a password, which is pretexting. Because it happens over the phone, it is also vishing. Legitimate IT staff never need a user’s password, so any such request should be refused and reported.

Phishing uses fraudulent emails designed to look like they come from trusted sources, such as banks or colleagues, to trick recipients into clicking malicious links, opening attachments, or entering credentials. Baiting relies on tempting physical items, pretexting uses a fabricated scenario to extract information, and tailgating involves following someone into a secure area.