Phishing 1

Which of the followings an attacker can do to perform a phishing attack? (Select all that applies)

• Create a malicious payload

• Purchase a malicious payload from a malware-as-a-service provider

• Purchase a software-as-a-service

• Purchase a platform-as-a-service

What does OSINT stand for?

• Open Source Intelligence

• Open Source Intelligence Network Traffic

• Open Server Integration

• Open Server Integration Network Traffic

Backdoor access provides the attacker with access to the system. Which of the following they can NOT do with this access?

• Execute malicious code.

• Exfiltrate data.

• Escalate privileges.

• Move laterally across the network.

• Evade detection

A threat actor sends an email to the CEO of CYDEO. Their goal is to manipulate the CEO into transferring a large sum of money to them. What type of phishing attack is this?

• Whaling

• Phishing

• CEO Fraud

• Spearphishing

Which of the followings, listed the stages of a social engineering attack lifecycle in a correct order?

• Reconnaissance

  Targeting

  Development

  Delivery

  Exploitation

  Installation

  Command and Control

• Reconnaissance

  Targeting

  Installation

  Delivery

  Exploitation

  Development

  Command and Control

• Reconnaissance

  Exploitation

  Installation

  Development

  Delivery

  Targeting

  Command and Control

• Reconnaissance

  Exploitation

  Installation

  Development

  Delivery

  Command and Control

  Targeting

You receive an email from CYDEO saying that your password has expired. There is a link to reset your password. When you check the URL it shows: cycleo.com. What type of link manipulation is this?

• Hidden URL

• IDN spoofing

• Open URL redirector

Phishing attacks can be associated with which MITRE ATT&CK tactics? (Select all that applies)

• Reconnaissance

• Resource Development

• Initial Access

• Execution

• Privilege Escalation

How can you protect yourself from link manipulation? (Select all that applies)

• Inspect the email contents for suspicious links.

• Go to the URL and check if it's trying to steal credentials.

• Check that the sender's email address is legitimate.

• Inspect the email headers.

• Check if the senders domain is on a blocklist.

Which of the followings is a type of email message that attempts to coerce the recipient into paying a ransom or making a payment in exchange for not carrying out an embarrassing or damaging information about the recipient?

• An extortion email attack

• A whaling attack

• A phishing attack

• A smishing attack

Extortion emails are usually phishing attempts and should be reported as such.

• True

• False