Question 1

Hoaxes,while a potential nuisance,can not cause any real harm to your data.

Accepted Answer

Hoaxes can potentially cause harm to your data by tricking you into downloading malicious software or giving away sensitive information. It's important to always verify sources before clicking on links or downloading anything.

Question 2

Which of the following is NOT an example of a poor security practice?

Accepted Answer

All the other examples listed are poor security practices, but allowing someone to bypass security measures without proper identification is not a recommended practice.

Question 3

An attacker watches people as they enter a building requiring a key card.He waits until he see someone who appears to be in a rush and has their hands full.He then intercepts the person,makes quick small talk,offers to help them hold what's in their hands while he swipes in,and follows behind.This is an example of

Accepted Answer

This is a social engineering technique known as piggybacking, where an attacker gains access to a secure area by following someone who has already been authorized to enter. The attacker takes advantage of the victim's trust, as they believe he is simply being helpful. This is a common physical security threat that can be prevented by ensuring that everyone entering a secure area has their own key card and is not permitted to hold open the door for someone else.

Question 4

When creating a password,users tend to use

Accepted Answer

Users often create passwords using personal information such as names of family members, pets, or favorite sports teams because these are easy for them to remember. However, this practice makes passwords more vulnerable to guessing or hacking through social engineering techniques.

Question 5

What are the security risks of installing games on an organization's system?

Accepted Answer

Users may unknowingly install games with hidden malware or viruses, which can compromise the security of an organization's system. It is important to ensure that all software installed on an organization's system is from a trusted source and thoroughly scanned for potential threats before installation.

Question 6

Installing unauthorized hardware such as a communication software and modem

Accepted Answer

Installing unauthorized hardware and software can open up backdoors that intruders can use to access the organization's systems, leading to security breaches. It is a risky practice and should not be encouraged.

Question 7

What is a good first step for companies to take to fight potential social engineering attacks?

Accepted Answer

Establishing policies and procedures dictating the roles and responsibilities of all users, as well as security administrators, can help ensure that everyone is aware of the risks of social engineering attacks and how to prevent them. This includes training employees on how to recognize suspicious activity and how to react to it. While virus protection software, monitoring phone calls, and conducting background checks are all valuable security measures, they may be insufficient to protect against social engineering attacks on their own.

Question 8

Spear phishing is when an attacker attempts to redirect a user to a bogus web site that appears similar to the web site the user had intended to access.

Accepted Answer

Spear phishing is a targeted email attack designed to trick individuals into revealing personal information or credentials, not primarily about redirecting users to bogus websites.

Question 9

Attackers need a certain amount of information before launching their attack.One common place to find information is to go through the trash of the target to find information that could be useful to the attacker.This process of going through a target's trash is known in the community as

Accepted Answer

Dumpster diving is the commonly used term in the security community for going through a target's trash in order to find potentially useful information for an attack. There is no such thing as trash rummaging or piggy diving, and while garbage surfing may exist as a term in some contexts, it is not commonly used in the context of security attacks.

Question 10

Social engineers attempt to convince authorized individuals to provide confidential information or access to an unauthorized individual.

Accepted Answer

Social engineering involves psychological manipulation to trick people into divulging confidential information or providing access to systems or areas they shouldn't. The individuals targeted in the social engineering attack are usually authorized to grant access or access the confidential information, but the attacker aims to convince them to do so for malicious purposes.

Question 11

All of the following are characteristics of a strong password EXCEPT:

Accepted Answer

A strong password should contain numbers and letters, be at least eight characters long, and include special characters. An uncommon dictionary word may not necessarily be strong enough to protect against hacking attempts. Therefore, C is not a characteristic of a strong password.

Question 12

When an attacker attempts to get credit card numbers using telephone and voice technologies,it's called

Accepted Answer

Vishing is a type of social engineering attack that involves the use of voice technologies, such as phone calls or voicemail messages, to trick individuals into revealing sensitive information like credit card numbers. Telephishing and phreaking are other types of attacks that involve using phone systems for malicious purposes but are not specific to obtaining credit card information. "Voicing" is not a recognized term in the context of cybersecurity.

Question 13

The only means of social engineering is through direct contact between the target and the attacker.

Accepted Answer

Social engineering can also be conducted through indirect means, such as phishing emails, phone calls, or using social media. Direct contact is not the only way for an attacker to manipulate or deceive someone into divulging sensitive information or taking an action that benefits the attacker.

Question 14

Which of the following is the weakest password?

Accepted Answer

Password B, "P@$$w0rd," is the weakest because it is a common word ("password") with simple character substitutions that are easily guessable and likely to be in cracking dictionaries.

Question 15

Phishing is the most common form of social engineering attack related to computer security.

Accepted Answer

Phishing is the most common form of social engineering attack, which is a type of cyber attack that involves tricking people into revealing sensitive information or performing certain actions, such as clicking on a malicious link or downloading malware. Other forms of social engineering attacks include baiting, pretexting, and tailgating.

Question 16

All of the following are techniques used by a social engineer EXCEPT:

Accepted Answer

Running a brute force attack on a password is not a social engineering technique; it is a hacking technique that involves using a software program to guess a user's password by trying countless combinations of characters until the correct one is found. The other options are social engineering techniques in which an attacker manipulates or deceives a target into giving up sensitive information or allowing unauthorized access.

Question 17

Users on your network receive an e-mail warning them of a dangerous computer virus.It instructs the user to delete files it claims were put there by the virus,but they are actually critical system files.This is an example of

Accepted Answer

This is an example of a hoax, where false information is spread to deceive or mislead individuals into taking actions that can harm their systems or compromise security. The email instructs users to delete critical system files, which can lead to system instability, malfunctions, or even data loss.

Question 18

A person parks his car by an ATM,sets up a small camera discreetly pointed at ATM keypad,and then pretends to be going through bank papers in his car.This would be an example of

Accepted Answer

This scenario describes shoulder surfing, where the person is attempting to observe the PIN being entered on the ATM keypad. Piggybacking refers to following someone into a secure location without authorization, phishing involves trying to obtain sensitive information through deception, and social engineering involves manipulating individuals to divulge confidential information. These do not apply to the given scenario.

Question 19

When and attacker tries to convince the target to initiate contact and then gets the target to give up confidential information,this is known as

Accepted Answer

Reverse social engineering involves an attacker convincing the target to initiate contact, during which the attacker then manipulates the target into divulging confidential information. Unlike traditional social engineering where the attacker initiates contact, in reverse social engineering, the attacker sets up a scenario where the target reaches out to them, often under the guise of needing help or solving a problem.

Question 20

Social engineers attempt to exploit the natural tendencies of people.They do this by

Accepted Answer

Social engineers often use emotional manipulation to exploit their targets. They may try to evoke sympathy by posing as someone in need, or they may try to create a sense of urgency or fear to pressure their targets into taking action. Starting with sympathy and then escalating to fear of confrontation is a common tactic. This can cause the target to let their guard down, making them more susceptible to the social engineer's manipulations.

Quiz 4: The Role of People in Security