Understanding Social Engineering Tactics

What does the term "social engineering" refer to in the context of cybersecurity?

• The process of building social media platforms

• Psychological manipulation of people into performing actions or divulging confidential information

• Engineering software for social networking sites

• The study of social behavior in large organizations

Which of the following best defines "pretexting" in social engineering?

• Sending mass emails to random recipients

• Using technical exploits to break into a system

• Creating a fabricated scenario to extract information from a target

• Monitoring network traffic for sensitive data

What is "phishing" as an information-gathering method?

• A technique used to physically break into secure facilities

• A fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity via electronic communication

• A method of encrypting data to prevent unauthorized access

• A process of scanning networks for open ports

Which of the following is an example of a "quid pro quo" social engineering attack?

• An attacker physically following an employee into a restricted area

• An attacker offering a service, such as IT support, in exchange for login credentials

• An attacker sending a malicious email attachment

• An attacker intercepting network communications

Which psychological principle does an attacker exploit when they create a sense of urgency in a phishing email, such as "Your account will be closed in 24 hours"?

• Reciprocity

• Social proof

• Scarcity and fear

• Liking and familiarity

An attacker calls an employee pretending to be from the IT department and asks them to reset their password over the phone. Which social manipulation tactic is primarily being used?

• Baiting

• Authority and impersonation

• Tailgating

• Watering hole attack

During an information-gathering phase, an attacker uses publicly available social media profiles, company websites, and press releases to learn about a target organization. What is this technique commonly called?

• Dumpster diving

• Open Source Intelligence (OSINT)

• Shoulder surfing

• Packet sniffing

A social engineer builds a long-term relationship with an employee over several months before asking for sensitive information. Which concept best explains why this tactic is effective?

• The attacker exploits the employee's fear of authority

• The employee is more likely to comply with requests from someone they trust and feel familiar with

• The employee is unaware of cybersecurity policies

• The attacker uses technical vulnerabilities to gain access

An attacker sends a spear-phishing email to a CFO that references a recent company merger and uses the CEO's name. How does this differ from a generic phishing attack, and why is it more dangerous?

• It is less dangerous because it targets only one person instead of many

• It is more dangerous because it is highly personalized using gathered intelligence, making it more convincing and harder to detect

• It is the same as generic phishing but uses a different email format

• It is more dangerous only because it uses encryption to hide the malicious content

Which of the following best explains why "dumpster diving" is considered an effective information-gathering method in social engineering?

• It allows attackers to physically access server rooms

• Organizations often discard documents containing sensitive information without proper destruction, making them accessible to attackers

• It enables attackers to intercept digital communications

• It provides attackers with real-time access to employee credentials