1. Social Engineering Attacks

Which tactic best reflects psychological manipulation used to lower a target’s defenses?

• Use technical jargon to overwhelm the target

• Demand immediate compliance with strict rules

• Quote legal statutes to pressure the user

• Provide a reason to justify an unusual request

An attacker deflects questions and changes the subject to avoid scrutiny. Which technique is being used?

• Provide a reason to justify the request

• Evasion and diversion to confuse the target

• Project confidence to reassure the target

• Make them laugh to build quick rapport

Which option describes spear phishing?

• Voice calls exploiting caller ID spoofing

• Mass emails sent to random consumers

• Highly targeted phishing aimed at one individual

• SMS messages asking for password resets

Which attack focuses on high‑profile executives or senior managers?

• Redirection via typo‑squatted domains

• Vishing using voice over IP calls

• Smishing through short text messages

• Whaling targeting organizational leaders

During a phone call, a threat actor poses as IT support to obtain MFA codes. What attack is this?

• Smishing using SMS messages

• Vishing through voice channels

• BEC impersonating finance staff

• Watering hole exploitation

A fake invoice email appears to come from a trusted supplier and alters payment instructions. Identify the attack.

• Disinformation spreading false rumors

• Redirection to ad‑filled websites

• General phishing with broad messaging

• Business Email Compromise manipulating payments

Which scenario best illustrates brand impersonation in social engineering?

• Masquerading as a well‑known company representative

• Sending SMS links for password updates

• Deflecting queries to avoid verification

• Using humor to create immediate trust

Match each phishing variant with its primary medium.

• SMS text messages

• Phishing (generic)

• Email or web announcements

• Smishing

• Highly targeted email

• Vishing

• Voice calls or VoIP

• Spear phishing

Which statement accurately distinguishes misinformation from disinformation?

• Misinformation is false but not deliberate

• Both are deliberate and malicious

• Disinformation is accidental and harmless

• Both are harmless warnings only

Typo squatting and pharming are examples of which broader tactic?

• Google dorking with advanced queries

• Redirection to fraudulent lookalike sites

• Whaling focused on senior managers

• Dumpster diving for discarded records