PenTest+ Social Engineering Attack Methodology Quiz

1. Which of the following best describes a quid pro quo attack?

Offering something of value in exchange for information or access

Sending unsolicited attachments

Copying trash documents

Recording phone conversations

Submit

4. Which attack type combines both digital and physical social engineering elements?

Pure phishing

Blended attack

Email spoofing only

DNS poisoning

5. In a social engineering test, what documentation is critical before conducting any assessment?

Written authorization and scope agreement

Only verbal approval

Anonymous consent

No documentation needed

6. Impersonation attacks are most successful when the attacker has researched the target organization and uses which technique?

Random guessing

Technical jargon and specific role-based details

Generic threats

Misspelled domain names

7. What is dumpster diving in the context of social engineering?

Searching through trash for discarded documents or information

Physically attacking a facility

Breaking into a database

Intercepting email messages

8. Which defense strategy is most effective against social engineering attacks?

Installing antivirus software only

Regular security awareness training and strong authentication policies

Using only command-line interfaces

Blocking all external communications

9. In the context of social engineering, what is OSINT primarily used for?

Gathering publicly available information about targets

Encrypting sensitive communications

Patching software vulnerabilities

Monitoring network traffic

10. Shoulder surfing is a social engineering technique where an attacker observes a victim typing passwords or PINs. What type of attack is this classified as?

Digital-only attack

Physical security bypass

Network-based attack

Cryptographic attack

11. What is the primary goal of a pretexting attack in social engineering?

Create a false scenario to build trust and extract information

Send malicious attachments via email

Exploit software vulnerabilities directly

Perform network packet sniffing

12. What is the primary purpose of a social engineering assessment in a penetration test?

To steal actual company data

To identify and document human vulnerabilities and security awareness gaps

To permanently disable security systems

To access the CEO's personal accounts

13. In a watering hole attack, what is the primary target?

Individual employees

Websites frequently visited by a specific group

The organization's main server

Random internet users

14. What psychological principle do attackers exploit when they create a false sense of urgency in a phishing email?

Authority

Scarcity

Reciprocity

Consistency

15. Vishing is a social engineering technique that uses which communication method?

Text messages

Voice calls (phone)

In-person meetings

Physical mail

16. Which attack involves leaving malicious USB drives or storage devices in public places hoping someone will use them?

Vishing

Baiting

Dumpster diving

Shoulder surfing

17. What does tailgating (or piggybacking) exploit in a physical security context?

Weak encryption algorithms

Social norms and politeness to gain unauthorized facility access

Default password configurations

SQL injection vulnerabilities

18. In spear phishing, attackers typically personalize messages using information gathered about the target from which source?

Random guessing

Social media, company websites, and OSINT

Network packet analysis

Firewall logs

19. What is phishing primarily designed to accomplish?

Steal credentials or personal information through deceptive emails

Physically access secure buildings

Intercept network traffic

Bypass firewall rules

20. Which social engineering technique involves impersonating an authority figure to pressure a target into disclosing sensitive information?

Tailgating

Phishing