Cyber Security Quiz: Social Engineering And Phishing

10 questions · exam conditions

0:00

Social Engineering And PhishingQuestion 1 of 10

A company requires passwords and authenticator-app push approvals for remote access. During a phishing exercise, a user visits a realistic login page, enters a password, and approves a push notification. The attacker immediately obtains an authenticated session through a reverse-proxy phishing site.

Which change would MOST directly prevent this attack technique while preserving remote access?

Require users to change passwords every 30 days and reject recently used passwords.

Replace push approvals with one-time codes generated by the same authenticator application.

Require phishing-resistant FIDO2 authentication bound to the legitimate service origin.

Display the remote-access portal's official URL during annual awareness training.

← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Social Engineering And Phishing

Practice Social Engineering And Phishing in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Social Engineering And Phishing, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which change would MOST directly prevent this attack technique while preserving remote access?

Require users to change passwords every 30 days and reject recently used passwords.
Replace push approvals with one-time codes generated by the same authenticator application.
Require phishing-resistant FIDO2 authentication bound to the legitimate service origin. (correct answer)
Display the remote-access portal's official URL during annual awareness training.

Explanation: When evaluating MFA bypass attacks, the critical question isn't whether multiple factors are used — it's whether those factors can be intercepted and replayed in real time. A reverse-proxy phishing site sits between the victim and the legitimate server, capturing credentials and MFA tokens as they're entered and forwarding them instantly to hijack a live session. Any factor that travels over the network as a replayable credential is vulnerable to this technique. This is exactly why C is correct. FIDO2 (WebAuthn) authentication is cryptographically bound to the origin — the exact domain of the legitimate service. When the authenticator signs a challenge, it includes the site's origin in that signature. A phishing domain is a different origin, so the credential simply won't work there. The attacker's proxy receives nothing usable. This is what "phishing-resistant" means in practice: the protocol itself breaks the attack, not user vigilance. A is a trap — frequent password rotation addresses password reuse and breach exposure, but the phishing attack already captures the current valid password in real time, so rotation frequency is irrelevant here. B sounds appealing because it replaces push approvals (which are trivially proxied) with TOTP codes, but TOTP codes are also replayable in real time through a reverse proxy — you've changed the token type without fixing the underlying vulnerability. D relies entirely on user behavior, which the scenario already demonstrates will fail under a realistic phishing simulation. Your study tip: on questions about phishing-resistant authentication, look for answers that make interception technically useless — not answers that make users harder to fool. Protocol-level protection beats awareness every time.

Question 2

A caller tells a help-desk analyst that an executive lost a phone while traveling and must enroll a replacement device immediately. The caller knows the executive's employee ID, manager's name, and recent travel destination. The caller also warns that delaying access will jeopardize a major contract.

What should the analyst do NEXT to best defend against this social-engineering attempt?

Ask additional questions based on public or personnel-directory information before resetting the device.
Send an approval request to the allegedly lost phone and proceed if the request is not denied.
Follow the documented recovery process using a separate verified identity channel and required approvals. (correct answer)
Perform the reset because the caller demonstrated knowledge of several executive-specific details.

Explanation: When a question describes someone using urgency, flattery, or insider-sounding details to pressure a help-desk analyst, you're being tested on your ability to recognize social engineering — specifically the pretexting technique, where an attacker constructs a convincing backstory to bypass security controls. The gold standard defense against social engineering is never letting claimed identity substitute for verified identity. Choice C is correct because documented recovery processes exist precisely for high-pressure moments like this one. Using a separate, verified identity channel — such as calling the actual executive back through a number on file, or requiring in-person verification — and obtaining required approvals ensures that no single caller can unilaterally trigger a sensitive action, regardless of how convincing they sound. Choice A is tempting but dangerously flawed: employee IDs, manager names, and travel destinations are all potentially discoverable through LinkedIn, social media, data breaches, or insider knowledge. Asking more of the same type of question doesn't raise the security bar — it just gives the attacker more opportunities to pass. Choice B is a critical trap. Sending an approval to the allegedly lost phone means the real owner can't respond, and silence (no denial) gets interpreted as approval — a process an attacker could exploit on purpose. Choice D is exactly what the attacker wants you to do. Knowledge of specific details feels like strong authentication but isn't — it's the core mechanic of pretexting. Your study takeaway: urgency plus insider knowledge is a red flag, not a green light. Legitimate executives understand security protocols; attackers weaponize time pressure to make you skip them.

Question 3

Employees begin receiving emails containing a QR code labeled "Updated Benefits Enrollment." The normal email gateway rewrites and analyzes clickable links, but the QR code directs users who scan it with a phone to a credential-harvesting site. Many employees use managed corporate phones.

Which control combination would MOST effectively address the technical gap exploited by this campaign?

Block all image attachments and require benefits notices to be sent as password-protected documents.
Expand gateway analysis to decode QR destinations and enforce web filtering on managed mobile devices. (correct answer)
Disable desktop browser scripting and require users to scan benefit notices only with personal phones.
Digitally sign internal benefits email and permit any QR destination contained in a signed message.

Explanation: When you see a scenario where a known security control is bypassed by a specific technique, your job is to identify exactly what the gap is and match it to a control that closes it — not just controls that sound security-conscious. Here, the gap is twofold: the email gateway analyzes clickable links but cannot decode QR codes (which are just encoded URLs embedded in images), and managed mobile devices have no web filtering enforced when users scan those codes. Answer B directly closes both holes — decoding QR destinations at the gateway subjects them to the same URL analysis as hyperlinks, and mobile web filtering catches the malicious destination even if a code slips through. This is precise, layered, and targets the actual attack vector. Answer A fails because blocking image attachments is far too broad and operationally disruptive, and switching to password-protected documents doesn't address QR-based phishing at all — attackers could simply pivot their delivery method. Answer C is dangerously counterproductive: disabling desktop scripting is irrelevant to a phone-based scan, and routing scans through personal devices actually removes the organization's ability to apply any mobile controls whatsoever, expanding the attack surface rather than shrinking it. Answer D is a classic trap — digital signing verifies the sender's identity but says nothing about the content's safety. A legitimate sender could be compromised, or a spoofed signature could be crafted; blindly trusting any QR code in a signed email would let attackers exploit exactly that assumption. Your study tip: on security questions, always identify the specific technical gap first, then eliminate answers that address a different gap or introduce new risks. Controls that sound strict aren't always controls that fit.

Question 4

A user receives a message inviting the user to review a shared document. The link opens the legitimate cloud provider's authorization page, where a third-party application requests permission to read email, access files, and maintain access when the user is offline. The user grants consent without entering a password into any untrusted page.

Which response MOST directly contains this form of phishing?

Reset the user's password and leave the application's existing authorization grant unchanged.
Revoke the application's consent and tokens, then review accessed data and tenant-wide grants. (correct answer)
Clear the user's browser history and require a password change at the next scheduled interval.
Validate the cloud provider's TLS certificate and retain the grant because the page was legitimate.

Explanation: When you see a scenario where a user grants permissions to a third-party app through a legitimate OAuth authorization page — without ever entering credentials on a fake site — you're looking at OAuth phishing (sometimes called "consent phishing"). The attacker never steals a password; instead, they steal access by tricking the user into granting a malicious app persistent, scoped permissions via legitimate infrastructure. The threat isn't the credential — it's the token. This means the correct response must eliminate the attacker's foothold, which lives in the authorization grant and its associated tokens, not in the user's password. Choice B does exactly this: revoking the application's consent and invalidating its tokens cuts off the attacker's access immediately, and auditing accessed data plus tenant-wide grants ensures no other users are compromised and reveals what data may have been exfiltrated. This is the complete, targeted remediation. Choice A is dangerously incomplete — resetting the password does nothing because the attacker never had the password to begin with. The malicious app's token remains valid and the breach continues. Choice C is similarly misdirected; clearing browser history is a cosmetic action with no security impact, and a scheduled password change ignores the actual attack vector entirely. Choice D is the most insidious distractor: the TLS certificate was legitimate, which is precisely what makes OAuth phishing so effective — validity of the page doesn't validate the requesting application's intentions. Your study tip: on questions involving OAuth or token-based attacks, always ask yourself "what does the attacker actually hold?" The response must revoke that asset, not a password the attacker never needed.

Question 5

An employee receives a message from benefits@company-enrollment.example. The organization uses company.example for corporate email. The message passes SPF, DKIM, and DMARC for company-enrollment.example and links to a polished page displaying the organization's logo.

Which conclusion is MOST accurate?

The message is suspicious because authentication can pass for an attacker-controlled lookalike domain. (correct answer)
The message is trustworthy because DMARC confirms that the sender is affiliated with the organization.
The message is trustworthy because a valid DKIM signature verifies the sender's individual identity.
The message is suspicious only if SPF fails after the employee opens the linked enrollment page.

Explanation: When a question involves email authentication (SPF, DKIM, DMARC), resist the temptation to treat a "pass" result as proof of legitimacy. These protocols only verify that a message is authentic for the domain it claims to be from — they say nothing about whether that domain belongs to a trustworthy organization. Here, the email comes from company-enrollment.example, not the organization's real domain company.example. An attacker can register a convincing lookalike domain, configure SPF, DKIM, and DMARC correctly for it, and send messages that pass all three checks flawlessly. Authentication passing simply means "this message genuinely came from company-enrollment.example" — not "company-enrollment.example is who you think it is." That's why A is correct: the domain mismatch is the red flag, and passing authentication on a lookalike domain is a well-known phishing technique. B is wrong because DMARC does not verify organizational affiliation. It only enforces alignment between the sending domain and the authenticated domain — both of which can belong to an attacker. C is wrong because DKIM verifies that the message content wasn't altered in transit and that it was signed by the claimed domain's private key; it does not verify any individual person's identity or their relationship to your organization. D is wrong because SPF is checked during delivery, not when a user clicks a link — and whether the linked page is malicious is a separate concern from SPF altogether. Your study tip: always separate "authentication passed" from "this sender is trustworthy." On exam questions, domain spoofing via lookalike domains is the classic trap for conflating the two.

Question 6

A security team runs quarterly phishing simulations. In the latest campaign, 8% of recipients clicked, 2% submitted credentials, 35% reported the message, and the median report arrived six minutes after delivery. The previous campaign used a less convincing pretext and produced a 4% click rate.

Which interpretation would provide the MOST defensible assessment of the organization's phishing resilience?

Resilience declined because the click rate doubled, regardless of differences in campaign difficulty or reporting.
Resilience improved because credential submission remained below the click rate during the latest campaign.
No conclusion is possible because simulation results cannot provide any useful security-performance evidence.
Evaluate reporting rate and reporting speed alongside normalized campaign difficulty and compromise actions. (correct answer)

Explanation: When assessing phishing resilience, you need to think beyond raw click rates and ask: what story does the full dataset tell, and is that story fairly interpreted? A single metric in isolation can mislead you, especially when campaign variables — like pretext difficulty — change between simulations. Answer D is correct because it describes the only methodology that accounts for the complete picture. Reporting rate (35%) and reporting speed (median six minutes) are strong positive indicators — employees are actively identifying threats quickly. But those strengths must be weighed alongside the harder pretext and the credential-submission rate to reach a defensible conclusion. Normalizing for campaign difficulty is essential: a harder simulation that yields a doubled click rate but faster reporting and low credential compromise may actually reflect improved resilience, not degraded performance. Answer A commits the most common analytical trap: cherry-picking the click rate without adjusting for the harder pretext. Comparing 8% to 4% across campaigns with different difficulty levels is like comparing test scores without accounting for test difficulty — the comparison is unfair and misleading. Answer B misreads the data. The fact that credential submissions (2%) were lower than clicks (8%) is mathematically expected — not every clicker submits credentials — so this relationship reveals nothing meaningful about resilience trends. Answer C overcorrects into nihilism. Simulation data is useful security-performance evidence when interpreted carefully. Dismissing it entirely is as wrong as misinterpreting it. Study tip: On security-metrics questions, watch for answers that isolate one data point and ignore confounding variables. Defensible security assessments always contextualize findings within methodology, difficulty, and multiple correlated indicators.

Question 7

At a badge-controlled office entrance, an unfamiliar person carrying several packages asks an employee to hold the door open. The person says a new badge has not yet been activated and points to a visible company logo on one package. Security policy requires all unbadged individuals to check in at reception.

Which employee response BEST balances security policy and personal safety?

Hold the door while recording the person's appearance for a possible report after entry.
Refuse entry, direct the person to reception, and notify security without physically confronting the person. (correct answer)
Ask the person to state an employee's name, then allow entry if the name appears in the directory.
Carry the packages through the door while requiring the person to remain outside the secured area.

Explanation: When you see a question about physical security and social engineering, ask yourself two things simultaneously: Does this response enforce policy? and Does it avoid creating a dangerous confrontation? The best answer threads both needles at once. Refusing entry, directing the person to reception, and quietly notifying security — choice B — achieves exactly that. It upholds the written policy requiring unbadged individuals to check in, removes any decision-making burden from the employee, and keeps a physical barrier between the employee and someone whose identity is unverified. Critically, it avoids direct confrontation, which protects the employee if the situation were to escalate. Choice A fails because recording and entering still grants access — you've allowed a potential threat past a controlled perimeter while only planning to report after the damage is done. Observation is not a substitute for enforcement. Choice C sounds reasonable but introduces a dangerous workaround: knowing an employee's name proves nothing. An attacker can easily research names from LinkedIn, a company website, or a prior conversation. Verifying a name from a public directory is not identity verification. Choice D is creative but impractical and still risky — it assumes the packages contain no threat and puts the employee in physical proximity to an unverified individual in a vulnerable, hands-full position. It also doesn't actually resolve whether the person gains entry through other means. Study tip: On security exams, answers that defer to proper procedure without physical engagement almost always beat answers that improvise a workaround. When in doubt, route the problem to the system, not yourself.

Question 8

An employee reports entering a password into a suspected phishing page and approving an unexpected multifactor prompt. Ten minutes later, monitoring detects a login from an unfamiliar network and the creation of a new inbox-forwarding rule. The employee has since changed the account password.

Which additional action set should incident responders prioritize?

Revoke active sessions and tokens, remove unauthorized rules, review all enrolled authentication factors, and investigate the full scope of account activity and data access. (correct answer)
Monitor for a second suspicious login from the same network, then block that IP address at the perimeter firewall and notify the employee to change their password again.
Restore the employee's previous password to re-establish the known credential state, disable forwarding for all users organization-wide, and archive the original phishing message for review.
Clear browser cookies and cached credentials on the employee's workstation, retain all existing trusted authentication devices, and close the incident once no further logins are observed.

Explanation: When responding to a compromised account, think in terms of complete containment before closure. The attacker has already stolen credentials and bypassed MFA by tricking the user into approving a push notification — a technique called MFA fatigue or prompt bombing. This means the threat isn't just the password; it's every active session, every enrolled factor, and every rule the attacker may have planted. Answer A is correct because it addresses all four pillars of proper account compromise response: killing live sessions and OAuth tokens (so the attacker loses access even with stolen credentials), removing the malicious forwarding rule (which would silently exfiltrate email even after remediation), auditing enrolled MFA devices (the attacker may have registered their own authenticator), and scoping the full damage (data accessed, emails read, lateral movement). Answer B is dangerously reactive — waiting for a second login before acting gives the attacker more time inside the account, and blocking a single IP is trivial to bypass with a VPN. It also ignores the forwarding rule already in place. Answer C contains two bad ideas: restoring a previous password doesn't help (the attacker already has sessions and may have enrolled their own MFA factor), and disabling forwarding organization-wide is a disproportionate, disruptive overreaction to a single account compromise. Answer D is fatally incomplete. Clearing browser cookies on the employee's workstation does nothing to invalidate server-side sessions the attacker holds remotely. Retaining all existing authentication devices ignores the possibility of a rogue enrolled factor. Your study tip: on incident response questions, always ask "does this action stop the attacker's current access, not just future access?" — that instinct will guide you toward complete containment answers like A.

Question 9

An accounts-payable employee receives an email from a long-standing supplier requesting that future payments be sent to a new bank account. The message comes from the supplier's usual address, appears in an existing email thread, and passes SPF, DKIM, and DMARC checks. The requested change is described as urgent because an invoice is due that afternoon.

Which action would BEST reduce the risk of fraud before the payment information is changed?

Reply within the existing thread and request written confirmation from the supplier's finance manager.
Approve the change because the authenticated message originated from the supplier's normal email domain.
Call a previously documented supplier contact using a known number and verify the request independently. (correct answer)
Forward the message to another accounts-payable employee and proceed if the formatting appears normal.

Explanation: This question tests your understanding of Business Email Compromise (BEC) — one of the most financially damaging social engineering attacks. The critical insight is that technical email authentication (SPF, DKIM, DMARC) only confirms a message originated from a legitimate mail server; it cannot confirm the human sender's true identity or intent. Attackers who have compromised a supplier's email account, or who have insider access, can send fully authenticated fraudulent messages. When you see urgent payment-change requests, your instinct should be: authentication ≠ legitimacy. C is correct because it breaks the attacker's control over the communication channel entirely. By calling a previously documented contact number — not one provided in the suspicious email — you force independent verification. Even if the email account is compromised, the attacker cannot intercept a phone call to a known number. A is wrong because replying within the existing thread keeps you inside the potentially compromised channel. If an attacker controls the supplier's inbox, they will simply confirm the fraudulent request in writing. Written confirmation from a compromised account proves nothing. B is wrong because it conflates technical authentication with trustworthiness. Passing SPF/DKIM/DMARC only means the email came from the supplier's mail server — it does not rule out account compromise or an authorized-but-malicious insider. D is wrong because peer review of formatting is not a security control. Normal-looking formatting is trivially easy for attackers to replicate, and a second set of eyes does not uncover account compromise. Study tip: On cybersecurity exams, any answer that keeps you inside the same potentially compromised channel is almost always a trap — always look for out-of-band verification as the preferred control.

Question 10

Several branded USB drives are left in an employee parking area. One employee connects a drive to a workstation to identify its owner. Automatic execution is disabled, but the employee manually opens a file named "Employee Bonus Plan," which exploits an unpatched document reader.

Which control would have MOST effectively reduced the combined social-engineering and technical risk in this scenario?

Enable automatic execution so endpoint protection can observe the device immediately after insertion.
Require complex workstation passwords because malicious removable media primarily relies on password guessing.
Rename sensitive internal documents so attackers cannot predict filenames likely to attract employee interest.
Train employees to surrender found media and restrict removable storage while maintaining application patches. (correct answer)

Explanation: When a question combines social engineering with a technical exploit, you need to find the control that addresses both attack vectors simultaneously — not just one. That's the key framing here. The scenario has two distinct problems: an employee was psychologically manipulated by a tempting filename ("Employee Bonus Plan"), and the workstation had an unpatched document reader that could be exploited. D directly neutralizes both. Security awareness training teaches employees to treat found media as suspicious and report it rather than plug it in — cutting off the social engineering path entirely. Restricting removable storage via policy adds a technical barrier, and keeping applications patched closes the exploit pathway even if someone does open a malicious file. Together, these controls attack the problem at both the human and technical layer. A is not only wrong — it's dangerous. Re-enabling autorun to "let antivirus observe" the device actually increases attack surface. Autorun was specifically disabled as a defense; reversing that is counterproductive and reflects a fundamental misunderstanding of endpoint security. B misidentifies the threat entirely. This attack had nothing to do with password guessing. Complex passwords protect against credential-based attacks, not malicious file execution. Applying an unrelated control to the wrong threat is a classic distractor pattern on security exams. C confuses attacker effort with attacker capability. Even if internal documents are renamed, an attacker can still label a payload anything enticing — "Payroll_2024" or "CEO_Message." This control would only minimally inconvenience an attacker while doing nothing to address the real risks. For security exam questions, always identify every threat vector in the scenario and look for the answer that covers all of them — single-layer controls are almost always distractors.