MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

What is the primary purpose of a whaling attack in cybersecurity?
a. Disrupting network connectivity
b. Targeting high-level executives for sensitive data
c. Damaging physical infrastructure
d. Spreading ransomware to all users
Answer: b. Targeting high-level executives for sensitive datafortinet+2
Whaling attacks are considered a subtype of which cyber attack technique?
a. Ransomware
b. Phishing
c. Botnet
d. Man-in-the-middle
Answer: b. Phishingtechtarget+2
Who are the most common targets in a whaling attack?
a. Helpdesk staff
b. IT technicians
c. C-suite executives
d. Interns
Answer: c. C-suite executivesrapid7+2
Which of these is NOT typically a characteristic of a whaling email?
a. Highly personalized content
b. Large-scale broadcast
c. Spoofed sender identity
d. Sense of urgency
Answer: b. Large-scale broadcastcrowdstrike+2
What is a common goal for cybercriminals conducting whaling attacks?
a. Infecting systems with adware
b. Authorizing high-value wire transfers
c. Disrupting website functionality
d. Mining cryptocurrencies
Answer: b. Authorizing high-value wire transfersfortinet+2
Whaling is different from standard phishing primarily because:
a. It uses only phone calls
b. It randomly targets any user
c. It carefully targets specific high-ranking individuals
d. It never impersonates colleagues
Answer: c. It carefully targets specific high-ranking individualstechtarget+2
In a whaling attack, which social engineering tactic is most frequently used?
a. Watering hole technique
b. Impersonation of trusted associates
c. Malware injection via USB
d. DDoS
Answer: b. Impersonation of trusted associatescisco+2
Which of these best describes the term “whaling” in cybersecurity?
a. Attacking marine data servers
b. Targeting executives with phishing schemes
c. Blocking network traffic
d. Cracking password hashes
Answer: b. Targeting executives with phishing schemescrowdstrike+2
Whaling emails are effective because they often include:
a. Random jokes
b. Inside organizational knowledge
c. Public advisories
d. Antivirus instructions
Answer: b. Inside organizational knowledgerapid7+2
Which is a real-world example of whaling?
a. Flooding a CEO’s inbox with spam
b. Convincing HR to send payroll records by impersonating the CEO
c. Auto-installing toolbar extensions
d. Running brute-force attacks on Wi-Fi
Answer: b. Convincing HR to send payroll records by impersonating the CEOfortinet+1
What tool is essential for defending against whaling attacks?
a. Single-factor authentication
b. Multi-factor authentication (MFA)
c. Autoplay USB drives
d. Default passwords
Answer: b. Multi-factor authentication (MFA)bitsight+2
Which of the following is LEAST likely to be a whaling target?
a. CEO
b. CFO
c. Janitorial staff
d. VP of operations
Answer: c. Janitorial stafftechtarget+2
The term “whale” in whaling refers to:
a. Very large corporate transactions
b. High-value, important executive targets
c. Big software vulnerabilities
d. The size of company data
Answer: b. High-value, important executive targetscrowdstrike+2
Which of these actions is most commonly requested in a whaling email?
a. Perform a system update
b. Approve a wire transfer or release sensitive data
c. Share personal vacation photos
d. Print confidential reports
Answer: b. Approve a wire transfer or release sensitive datarapid7+2
Attackers gather information for whaling attacks primarily through:
a. Physical mail
b. Social media and corporate websites
c. Public TV ads
d. Weather reports
Answer: b. Social media and corporate websitesbitsight+2
What type of organization is most at risk for whaling attacks?
a. Small, non-digital businesses
b. Organizations with high-value executives and financial assets
c. Rural libraries
d. Home users
Answer: b. Organizations with high-value executives and financial assetstechtarget+1
Which response is vital when a suspected whaling email is received?
a. Forwarding the message widely
b. Verifying via an independent channel before acting
c. Opening all attachments immediately
d. Ignoring and deleting
Answer: b. Verifying via an independent channel before actingmemcyco+1
Why is it difficult to detect whaling attacks compared to regular phishing?
a. They use outdated lingo
b. They exploit personal knowledge and real situations
c. They lack any sense of urgency
d. They always use SMS
Answer: b. They exploit personal knowledge and real situationsfortinet+2
Which physical approach is sometimes used to support a whaling attack?
a. Dumpster diving for company information
b. Modifying hardware chips
c. Rewiring routers
d. Creating physical mail spam
Answer: a. Dumpster diving for company informationcrowdstrike
Training for which group is most essential to stop whaling?
a. Entry level IT support
b. Executives and senior management
c. Junior interns
d. External contractors
Answer: b. Executives and senior managementblackcloak+1
An email from a “CEO” asking for urgent funds transfer is suspicious because it might be:
a. An internal memo
b. A whaling attack
c. A team announcement
d. Daily newsletter
Answer: b. A whaling attackrapid7+2
What is the difference between whaling and spear phishing?
a. Whaling is less targeted
b. Whaling specifically targets high-level executives, spear phishing may target any individual
c. Both target only low-level employees
d. Spear phishing uses SMS
Answer: b. Whaling specifically targets high-level executives, spear phishing may target any individualtechtarget+1
What can be a strong indicator of a whaling attack attempt?
a. A generic greeting in email
b. Apparent knowledge of confidential company projects
c. Messages about upcoming holidays
d. Coupons for free software
Answer: b. Apparent knowledge of confidential company projectsfortinet+1
What role does business email compromise (BEC) play in whaling?
a. Directs all spam to junk
b. Facilitates the impersonation of executives for fraudulent wire transfers
c. Eliminates malware
d. Sends auto-responses
Answer: b. Facilitates the impersonation of executives for fraudulent wire transferscrowdstrike+1
Whaling typically involves attackers taking which of the following steps first?
a. Random mass mailing
b. Researching targets in depth
c. Posting flyers
d. Calling customer support
Answer: b. Researching targets in depthtechtarget+1
Which best practice helps reduce exposure to whaling attacks?
a. Avoiding all phone calls
b. Regular anti-phishing training for senior staff
c. Disabling company firewalls
d. Ignoring suspicious emails
Answer: b. Regular anti-phishing training for senior staffmemcyco+2
Whaling attacks are often disguised as:
a. Personal family updates
b. Routine executive communications
c. Public newsletters
d. Security patch releases
Answer: b. Routine executive communicationscisco+1
Which control specifically helps to identify abnormal executive requests?
a. System volume monitoring
b. Email pattern analysis software
c. Lack of backups
d. Random password changes
Answer: b. Email pattern analysis softwarebitsight
Using which authentication can help in detecting unauthorized access during a whaling attempt?
a. Simple passwords
b. Multi-factor authentication (MFA)
c. Guest accounts
d. Static tokens
Answer: b. Multi-factor authentication (MFA)bitsight+1
What element is most exploited in whaling attacks?
a. Software vulnerabilities
b. Human psychology and authority trust
c. Firewall configurations
d. Hardware drivers
Answer: b. Human psychology and authority trustcisco+2
A whaling attack on which department could result in massive payroll data loss?
a. IT support
b. HR/Payroll department
c. Maintenance staff
d. Marketing team
Answer: b. HR/Payroll departmentfortinet
What should an employee do if they get a suspicious financial request from an executive over email?
a. Respond immediately
b. Double-check identity via a call or face-to-face
c. Forward to everyone in the department
d. Ignore the message
Answer: b. Double-check identity via a call or face-to-facememcyco+1
Which of these approaches is LEAST effective in mitigating whaling?
a. Limited executive training
b. Regular simulated phishing tests
c. Strong access management
d. Anti-phishing solutions
Answer: a. Limited executive trainingblackcloak+2
If a whaling email includes a legitimate-looking signature and inside-jokes, what does it show?
a. Use of brute force hacking
b. Deep reconnaissance by attackers
c. Universal email template
d. Lack of attempt to deceive
Answer: b. Deep reconnaissance by attackerscrowdstrike+1
What is a sign an executive might be under a whaling attempt?
a. Mass marketing emails
b. Personalized, urgent requests for confidential data
c. System maintenance alerts
d. Company-wide announcements
Answer: b. Personalized, urgent requests for confidential databitsight+2
Which emerging technology is increasingly helping block whaling?
a. AI-powered email filters
b. Typewriters
c. Paper mailtracking
d. Basic user firewalls
Answer: a. AI-powered email filtersbitsight
Attackers use social media for whaling attack preparation because:
a. It’s easy to reach everyone
b. They can gather personal and professional target details
c. To generate news
d. To get software updates
Answer: b. They can gather personal and professional target detailstechtarget+1
What can organizations do to test their readiness for whaling?
a. Conduct regular whaling simulation exercises
b. Only focus on malware detection
c. Disable internet for executives
d. Restrict all incoming emails
Answer: a. Conduct regular whaling simulation exercisesmemcyco
Whaling emails often attempt to instill which emotion to prompt hasty action?
a. Calmness
b. Urgency or panic
c. Excitement about a prize
d. Boredom
Answer: b. Urgency or panicrapid7+1
Why is privilege management important for whaling prevention?
a. It confuses attackers
b. Minimizes damage by limiting access to sensitive data
c. Encourages data sharing
d. Increases user access
Answer: b. Minimizes damage by limiting access to sensitive databitsight
Which major incident is often cited as a whaling example?
a. Mass ransomware attacks
b. Seagate’s release of W2s after a spoofed executive request
c. DDoS on social media
d. IoT botnets
Answer: b. Seagate’s release of W2s after a spoofed executive requestfortinet
What is a recommended policy for preventing whaling?
a. Approve large fund transfers via email only
b. Always verify high-value requests through a second channel
c. Share all passwords with assistants
d. Lock all emails after work hours
Answer: b. Always verify high-value requests through a second channelmemcyco
Which of these is NOT a typical whaling attack vector?
a. Spoofed emails
b. Socially engineered phone calls
c. Physical letters
d. Malicious attachments
Answer: c. Physical lettersibm+2
Whaling attacks often use knowledge of the target’s:
a. Professional vacations and travel schedules
b. Favorite sports teams only
c. Personal home addresses
d. Childhood friends
Answer: a. Professional vacations and travel schedulescrowdstrike
What approach presents the greatest risk from whaling if ignored?
a. Regular password rotation
b. Executive cyber awareness training
c. Encryption of hard drives
d. Asset inventory checks
Answer: b. Executive cyber awareness trainingblackcloak+2
In whaling, why is it effective to mimic communication styles of real executives?
a. Increases the chance low-level workers will notice the scam
b. Builds credibility and increases the likelihood of action by target
c. Slows down communication
d. Reduces the chance of being detected
Answer: b. Builds credibility and increases the likelihood of action by targetfortinet+1
Security administrators can reduce whaling by:
a. Conducting basic IT orientation only
b. Encouraging security awareness and phishing-specific trainings for management
c. Shutting down internet access
d. Disabling all mobile devices
Answer: b. Encouraging security awareness and phishing-specific trainings for managementblackcloak+1
Which defense most directly reduces risk from whaling?
a. Anti-malware software
b. Strong identity and access management for executives
c. System backups
d. Hardware upgrades
Answer: b. Strong identity and access management for executivesrapid7+1
Successful whaling attacks inflict corporate damage by causing:
a. Brand and financial losses
b. Printer errors
c. Office redesigns
d. Software license confusion
Answer: a. Brand and financial lossesrapid7+2
Which is a best practice for protecting against whaling in the modern workplace?
a. Only restrict social media for interns
b. Promote safe social media and regular verification of unexpected executive requests
c. Disable backup solutions
d. Require managers to use public Wi-Fi
Answer: b. Promote safe social media and regular verification of unexpected executive requestsmemcyco+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info