MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Social engineering primarily exploits which aspect of security?
   a. Hardware
   b. Software
   c. Human psychology
   d. Network protocols
   Answer: c. Human psychologysanfoundry​
2. Which of the following is NOT considered a social engineering tactic?
   a. Tailgating
   b. Phishing
   c. Pretexting
   d. Spamming
   Answer: d. Spammingsanfoundry​
3. The main objective of a phishing attack is to:
   a. Install malware
   b. Obtain sensitive information
   c. Slow down networks
   d. Test passwords
   Answer: b. Obtain sensitive informationexamradar​
4. What best describes “pretexting” in social engineering?
   a. Socializing with the target
   b. Establishing a fabricated scenario to obtain data
   c. Destroying physical documents
   d. Sending spam emails
   Answer: b. Establishing a fabricated scenario to obtain datasanfoundry​
5. Baiting attacks typically rely on:
   a. Intimidation
   b. Free offers or enticing items
   c. Eavesdropping
   d. Email attachments
   Answer: b. Free offers or enticing itemsexamradar​
6. “Vishing” refers to social engineering over which communication channel?
   a. Physical mail
   b. Voice/telephone
   c. Email
   d. SMS
   Answer: b. Voice/telephoneexamradar​
7. Which psychological principle makes people more likely to respond to requests from a recognized leader?
   a. Scarcity
   b. Commitment
   c. Authority
   d. Liking
   Answer: c. Authoritycde.state​
8. What is the primary defense against social engineering?
   a. Encryption
   b. User awareness training
   c. Intrusion detection systems
   d. Antivirus software
   Answer: b. User awareness trainingscribd​
9. Dumpster diving is a method in which attackers:
   a. Tailgate into buildings
   b. Search trash for confidential information
   c. Spoof caller IDs
   d. Hack wireless networks
   Answer: b. Search trash for confidential informationsanfoundry​
10. Which of the following is an example of “tailgating”?
    a. Sending spam emails
    b. Following someone into a secure building without authorization
    c. Sniffing network traffic
    d. Lock picking
    Answer: b. Following someone into a secure building without authorizationvinsys​
11. Social engineers frequently rely on people’s willingness to:
    a. Ignore strangers
    b. Help others
    c. Destroy evidence
    d. Memorize passwords
    Answer: b. Help othersimperva​
12. Phishing can be best described as:
    a. Gaining access via physical locks
    b. Trickery through digital messages
    c. Hacking wireless networks
    d. Eavesdropping on phone calls
    Answer: b. Trickery through digital messagesproofpoint​
13. Which influence principle involves convincing the target that “everyone else is doing it”?
    a. Reciprocity
    b. Authority
    c. Social proof
    d. Scarcity
    Answer: c. Social proofcde.state​
14. An attacker pretending to be a helpdesk agent to get a password is practicing:
    a. Baiting
    b. Pretexting
    c. Eavesdropping
    d. Shoulder surfing
    Answer: b. Pretextingexamradar​
15. Social engineering attacks that exploit FOMO (fear of missing out) primarily use:
    a. Scarcity
    b. Reciprocity
    c. Liking
    d. Social proof
    Answer: a. Scarcitycde.state​
16. Which of the following is a technology defense that specifically helps mitigate social engineering?
    a. SSL/TLS certificates
    b. Firewalls
    c. Multi-factor authentication
    d. Encryption
    Answer: c. Multi-factor authenticationlivingsecurity​
17. A social engineer uses false scenarios to extract information. This reflects:
    a. Phishing
    b. Pretexting
    c. Dumpster diving
    d. Baiting
    Answer: b. Pretextingexamradar​
18. The concept of “liking” in social engineering refers to:
    a. Friendship-based manipulation
    b. Familiarity with websites
    c. Using popular software
    d. Preferring certain brands
    Answer: a. Friendship-based manipulationhoxhunt​
19. What is a “honey trap” in social engineering?
    a. Malware disguised as a game
    b. Person lures victim through romance
    c. Email bomb
    d. Fake antivirus pop-ups
    Answer: b. Person lures victim through romancecopado​
20. Which is a common goal of social engineering?
    a. To disable security systems
    b. To manipulate individuals to reveal sensitive information
    c. To install ransomware
    d. To damage hardware
    Answer: b. To manipulate individuals to reveal sensitive informationexamradar​
21. Social engineering is most effective when the target:
    a. Is well trained
    b. Has little security awareness
    c. Uses firewalls
    d. Uses encryption
    Answer: b. Has little security awarenessbarracuda​
22. A social engineer emails an employee, pretending to be IT support and asks for login credentials. This is:
    a. Credential stuffing
    b. Impersonation attack
    c. Baiting
    d. Insider threat
    Answer: b. Impersonation attackexamradar​
23. “Quid pro quo” attacks are based on which psychological principle?
    a. Authority
    b. Reciprocity
    c. Commitment
    d. Social proof
    Answer: b. Reciprocitycde.state​
24. Social engineers manipulate victims primarily through:
    a. Technical vulnerabilities
    b. Human behavior
    c. Weak encryption
    d. Physical attacks
    Answer: b. Human behavioribm​
25. The best way to confirm if a request for sensitive information is legitimate is to:
    a. Ask friends
    b. Respond immediately
    c. Independently verify the identity of requester
    d. Forward the email
    Answer: c. Independently verify the identity of requesterexamradar​
26. In a “watering hole” attack, the attacker:
    a. Infects a physical water supply
    b. Compromises a website frequented by the target
    c. Plants malware on USB drives
    d. Performs eavesdropping
    Answer: b. Compromises a website frequented by the targetcopado​
27. Which attack involves secretly observing someone entering sensitive information?
    a. Pretexting
    b. Shoulder surfing
    c. Phishing
    d. Vishing
    Answer: b. Shoulder surfingvinsys​
28. Attackers often target high-ranking executives. These social engineering attacks are called:
    a. Smishing
    b. Whaling
    c. Pharming
    d. Watering hole
    Answer: b. Whalingcopado​
29. Which of the following is NOT a method of social engineering?
    a. Brute force attacks
    b. Vishing
    c. Pretexting
    d. Phishing
    Answer: a. Brute force attackssanfoundry​
30. The “commitment and consistency” principle is best explained by:
    a. People doing what they’ve agreed to previously
    b. People following orders
    c. People emulating groups
    d. People acting on impulse
    Answer: a. People doing what they’ve agreed to previouslycde.state​
31. Social engineering attacks can be thwarted by:
    a. Technology only
    b. User education, policies, and technology
    c. Antivirus only
    d. Firewalls only
    Answer: b. User education, policies, and technologyscribd​
32. An email that threatens negative consequences unless you act quickly is using:
    a. Liking
    b. Authority
    c. Scarcity
    d. Fear
    Answer: d. Fearhoxhunt​
33. Which term refers to a social engineer’s use of urgent language to provoke quick action?
    a. Scarcity
    b. Pretexting
    c. Impersonation
    d. Persistence
    Answer: a. Scarcitycde.state​
34. A common sign of phishing is:
    a. Personalized greetings
    b. Grammatical errors and urgent requests
    c. Use of official channels
    d. Digital signatures
    Answer: b. Grammatical errors and urgent requestsexamradar​
35. What makes social engineering distinct from other cyberattacks?
    a. Exploits network protocols
    b. Relies on physical damage
    c. Manipulates human psychology
    d. Uses only malware
    Answer: c. Manipulates human psychologyimperva​
36. Which of these is a principle of influence in social engineering?
    a. Repetition
    b. Scarcity
    c. Deception
    d. Persistence
    Answer: b. Scarcitycde.state​
37. “SMiShing” refers to social engineering attacks performed via:
    a. Social media
    b. Telephone
    c. SMS/text messages
    d. In-person meetings
    Answer: c. SMS/text messagescopado​
38. An employee is tricked into installing spyware by a pop-up that claims their PC is infected. This is an example of:
    a. Phishing
    b. Baiting
    c. Vishing
    d. Pretexting
    Answer: b. Baitingexamradar​
39. Which method is used to manipulate targets into making decisions by showing “authorized” approval?
    a. Commitment
    b. Authority
    c. Reciprocity
    d. Social proof
    Answer: b. Authoritycde.state​
40. What is the first phase in the social engineering attack framework?
    a. Relationship development
    b. Exploitation
    c. Attack formulation
    d. Information gathering
    Answer: c. Attack formulationhoxhunt​
41. Social engineers gain targets’ trust by:
    a. Using technical knowledge only
    b. Building relationships and rapport
    c. Demonstrating coding skill
    d. Threatening force
    Answer: b. Building relationships and rapporthoxhunt​
42. Which method involves impersonating police officers or IT staff?
    a. Watering hole
    b. Tailgating
    c. Impersonation
    d. Quid pro quo
    Answer: c. Impersonationproofpoint​
43. The principle of “social validation” is also known as:
    a. Social proof
    b. Pretexting
    c. Reciprocity
    d. Authority
    Answer: a. Social proofcde.state​
44. Technical controls for social engineering include:
    a. Email filtering and multi-factor authentication
    b. Hardware firewalls only
    c. Static passwords
    d. None of the above
    Answer: a. Email filtering and multi-factor authenticationlivingsecurity​
45. The best method to prevent dumpster diving is:
    a. Shredding and securing disposal of documents
    b. Frequent password changes
    c. Account lockout policies
    d. Installing firewalls
    Answer: a. Shredding and securing disposal of documentssanfoundry​
46. Attacks leveraging a person’s desire to return a favor utilize:
    a. Scarcity
    b. Reciprocity
    c. Authority
    d. Pretexting
    Answer: b. Reciprocitycde.state​
47. Which is the most targeted group for social engineering?
    a. Only IT professionals
    b. Frontline employees
    c. Executives
    d. Everyone in an organization
    Answer: d. Everyone in an organizationibm​
48. Which scenario is an example of the “liking” principle?
    a. Urgent deadline
    b. Request from a friend
    c. Limited-time offer
    d. Order from a boss
    Answer: b. Request from a friendcde.state​
49. Multi-factor authentication is advised because:
    a. It’s cheaper
    b. It compensates for weak human vigilance
    c. It needs no passwords
    d. It avoids technical attacks
    Answer: b. It compensates for weak human vigilancelivingsecurity​
50. Why is user awareness key to preventing social engineering?
    a. It helps users spot suspicious behavior and act cautiously
    b. It provides instant defense
    c. It automates password resets
    d. It disables accounts
    Answer: a. It helps users spot suspicious behavior and act cautiouslyscribd​

1. https://www.sanfoundry.com/cyber-security-questions-answers-social-engineering-physical-hacking/
2. https://examradar.com/social-engineering-mcqs/
3. https://www.cde.state.co.us/dataprivacyandsecurity/socialengineeringeducation
4. https://www.scribd.com/document/722589683/Cyber-Security-Mcq
5. https://www.vinsys.com/blog/top-30-mcqs-ceh-exam-preparation
6. https://www.imperva.com/learn/application-security/social-engineering-attack/
7. https://www.proofpoint.com/us/threat-reference/social-engineering
8. https://www.livingsecurity.com/blog/social-engineering-guide
9. https://hoxhunt.com/blog/social-engineering
10. https://www.copado.com/resources/blog/12-types-of-social-engineering-attacks-to-look-out-for
11. https://www.barracuda.com/support/glossary/social-engineering
12. https://www.ibm.com/think/topics/social-engineering
13. https://www.sanfoundry.com/1000-cyber-security-questions-answers/
14. https://www.includehelp.com/mcq/cyber-security-mcqs.aspx
15. https://examradar.com/phishing-and-social-engineering-mcqs-multiple-choice-questions-with-answers/
16. https://www.theknowledgeacademy.com/blog/cyber-security-mcq-and-answers/
17. https://www.igmguru.com/blog/cyber-security-mcqs
18. https://www.interviewbit.com/cyber-security-mcq/
19. https://www.scribd.com/document/420997020/Quiz
20. https://en.wikipedia.org/wiki/Social_engineering_(security)