Social Engineering Attacks (PenTest+) Quiz

1. In reverse social engineering, the attacker positions themselves as a helper. What is the attacker's ultimate goal?

To gain the target's trust and extract information

To provide legitimate technical support

To encrypt the target's files

To block network access

2. True or False: Social engineering is a valid technique for authorized penetration testing when proper consent is obtained.

True

False

3. True or False: Phishing emails always contain obvious spelling and grammar errors.

True

False

Submit

5. Social engineers often research their targets using open-source intelligence. Which is a common OSINT source?

LinkedIn, company websites, social media profiles

Only classified databases

Encrypted internal systems

Password-protected servers

6. Which security control is most effective against tailgating?

Badge access systems with individual verification

Posting 'No Tailgating' signs

Trusting employee judgment

Using unlocked doors

7. An attacker calls an employee claiming to be from IT support and requests their password. What type of attack is this?

Vishing and pretexting

Phishing

Baiting

Tailgating

8. What is the best defense against phishing attacks?

User awareness training and email security tools

Ignoring all emails

Using only phone calls

Disabling all email features

9. A penetration tester conducts Social Engineering Attacks (PenTest+) to identify human vulnerabilities. What should they do before beginning?

Obtain written authorization and define scope

Start attacking without approval

Use personal credentials

Target the CEO first

10. Which email indicator is a red flag for phishing attempts?

Urgency, requests for credentials, suspicious links or attachments

Professional formatting only

Emails from known senders only

All emails with attachments

11. What is the primary goal of a phishing attack?

To steal credentials or sensitive information through deceptive emails

To physically access a secure facility

To overload a server with traffic

To encrypt files for ransom

12. Dumpster diving involves searching through trash for discarded documents. What type of sensitive data is commonly found?

Passwords, account numbers, employee directories

Only encrypted files

Backup tapes only

Network topology diagrams exclusively

13. What psychological principle do social engineers exploit when using authority impersonation?

People tend to obey authority figures

People always verify identities

People ignore requests from strangers

People require written confirmation

14. Shoulder surfing is a technique where an attacker observes sensitive information by looking over someone's shoulder. Where is this most commonly performed?

Public areas like airports, cafes, or offices

Only in secure data centers

Exclusively online

During encrypted video calls

15. In a quid pro quo attack, what does the attacker offer in exchange for information?

A service or benefit

Malware

Physical access

Network credentials

16. Which of the following is NOT a common social engineering technique?

Quid pro quo

Authority impersonation

Encryption key rotation

Reverse social engineering

17. Tailgating is a physical security breach where an unauthorized person gains access by following an authorized employee. What is another common term for this?

Piggybacking

Shoulder surfing

Dumpster diving

Man-in-the-middle

18. What does 'vishing' refer to in social engineering?

Voice-based phishing via phone calls

Visiting a target's office

Visual inspection of networks

Virtual private network attacks

19. Which social engineering technique involves leaving malware-infected USB drives in public areas?