Cybersecurity EOY FInal Exam Review

A set of methods used by cyber criminals to deceive individuals into handing over information that they can use for fraudulent purposes’ is a definition of what?

• Impersonatin

• Shoulder Surfing

• Phishing

• Social Engineering

What is one way somebody could protect themselves from shoulder surfing?

• share your pin with someone you trust

• create a pin that is easy to remember

• have a pin that is the same as your friends

• be aware of who is around you

While waiting in the lobby of your building for a guest, you notice a man in a red shirt standing close to a locked door with a large box in his hands. He waits for someone else to come along and open the locked door and then proceeds to follow her inside. What type of social engineering attack have you just witnessed?

• Impersonation

• Phishing

• Boxing

• Tailgating

 A user in your organization contacts you to see if there’s any update to the “account compromise” that happened last week. When you ask him to explain what he means, and the user tells you he received a phone call earlier in the week from your department and was asked to verify his user ID and password. The user says he gave the caller his user ID and password. This user has fallen victim to what specific type of attack?

• Spear phishing

• Vishing

• Phishing

• Replication

Coming into your office, you overhear a conversation between two security guards. One guard is telling the other she caught several people digging through the trash behind the building early this morning. The security guard says the people claimed to be looking for aluminum cans, but only had a bag of papers—no cans. What type of attack has this security guard witnessed?

• Spear phishing

• Pharming

• Dumpster diving

• Rolling refuse

Which of the following is a type of social engineering attack in which an attacker attempts to obtain sensitive information from a user by masquerading as a trusted entity in an e-mail?

• Phishing

• Pharming

• Spam

• Vishing

Which of the following is/are psychological tools used by social engineers to create false trust with a target?

• Impersonation

• Urgency or scarcity

• Authority

• All of the above

Your boss thanks you for pictures you sent from the recent company picnic. You ask him what he is talking about, and he says he got an e-mail from you with pictures from the picnic. Knowing you have not sent him that e-mail, what type of attack do you suspect is happening?

• Phishing

• Spear phishing

• Reconnaissance

• Impersonation

Lisa received a phone call at work from someone identifying themselves as a person who sells the company hardware regularly. He said he's calling customers to inform them of a problem with database servers they've sold, but he said the problem only affects servers running a specific operating system version. He asks Lisa what OS versions the company is running. Which BEST describes this tactic?

• Pretexting

• Tailgating

• Pharming

• Smishing

Answer explanation

He used pretexting by setting up a story that has a better chance of someone giving him information. If he just asked for the operating system without the pretext, he wouldn't have had a very good chance of success.

A man in a maintenance uniform walked up to your organization's receptionist desk. He said he was called by the CIO (Chief Information Officer) and asked to fix an issue with the phones and needed access to the wiring closet. The receptionist asked the man to show his building access badge, and then she verified that he was on the list of approved personnel to access this secure area. What type of attack will the checks the receptionist performed prevent?

• Tailgating

• Phishing

• Impersonation

• Whaling

Answer explanation

These checks prevent impersonation (where someone pretends to be someone they are not). By saying he was called by the CIO, he also used pretexting. Tailgating is when one person follows closely behind another person without showing credentials. Phishing is when someone sends an email to users with the sole purpose of tricking them into revealing personal information or clicking a link. Whaling is a form of spear phishing that attempts to target high-level executives.