Welcome to the Exploiting Physical and Social Vulnerabilities MCQs Page

Dive deep into the fascinating world of Exploiting Physical and Social Vulnerabilities with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Exploiting Physical and Social Vulnerabilities, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Exploiting Physical and Social Vulnerabilities, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Exploiting Physical and Social Vulnerabilities. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Exploiting Physical and Social Vulnerabilities. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Exploiting Physical and Social Vulnerabilities MCQs | Page 3 of 7

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Penetration Testing

02

Planning and Scoping Penetration Tests 🔒

03

Information Gathering 🔒

04

Vulnerability Scanning 🔒

05

Analyzing Vulnerability Scans

06

Exploiting and Pivoting 🔒

07

Exploiting Network Vulnerabilities 🔒

08

Exploiting Application Vulnerabilities 🔒

09

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

10

Reporting and Communication

11

Scripting for Penetration Testing 🔒

Q21.

What is elicitation in the context of social engineering?

Directly asking for information

Getting information without directly asking for it

Creating false identities

Impersonating another person

Discuss

Answer: (b).Getting information without directly asking for it Explanation:Elicitation in social engineering involves getting information without directly asking for it. This technique focuses on asking indirect questions or discussing unrelated topics that may lead the target to reveal the desired information.

Q22.

What is a common tactic in elicitation that involves using open-ended or leading questions?

Impersonation

Interrogation

Quid pro quo

Shoulder surfing

Discuss

Answer: (a).Impersonation Explanation:Impersonation is a common tactic in elicitation that involves disguising oneself as another person to gain access to information. This may include wearing a uniform, presenting a false ID, or claiming to be a staff member.

Q23.

What does impersonation involve in social engineering?

Directly asking for information

Asking open-ended questions

Disguising oneself as another person

Using USB drop attacks

Discuss

Answer: (c).Disguising oneself as another person Explanation:Impersonation in social engineering involves disguising oneself as another person to gain access to facilities or resources. This can range from claiming to be a staff member to wearing a uniform and presenting a false or cloned company ID.

Q24.

What do quid pro quo attacks rely on in social engineering?

Creating perceived trust

Offering something of value

Watching over a target's shoulder

Using USB drop attacks

Discuss

Answer: (b).Offering something of value Explanation:Quid pro quo attacks in social engineering rely on the social engineer offering something of value to the target. This creates a sense of indebtedness and builds perceived trust, making the target more likely to cooperate.

Q25.

What is the term for watching over a target's shoulder to obtain valuable information?

Interrogation

Shoulder surfing

Elicitation

USB drop attacks

Discuss

Answer: (b).Shoulder surfing Explanation:Shoulder surfing is the term for watching over a target's shoulder to obtain valuable information, such as passwords or access codes. This technique involves visually observing the target's actions.

Q26.

In the context of penetration testing, under what circumstances might bribery be considered a valid technique?

Bribery is always a valid technique in penetration testing.

Bribery is never considered a valid technique.

Bribery may be considered a valid technique under some circumstances.

Bribery is only valid in web-based social engineering attacks.

Discuss

Answer: (c).Bribery may be considered a valid technique under some circumstances. Explanation:Bribery may be considered a valid technique under some circumstances in penetration testing. However, it is a sensitive topic and should be carefully addressed through scoping agreements and rules of engagement.

Q27.

What is vishing in the context of phishing attacks?

Phishing via email

Phishing via SMS messages

Social engineering over the phone system

Targeting high-profile individuals in an organization

Discuss

Answer: (c).Social engineering over the phone system Explanation:Vishing, or voice phishing, is social engineering over the phone system. It often relies on caller ID spoofing tools to make the calls more believable.

Q28.

What is whaling in the context of phishing attacks?

Phishing via email

Phishing via SMS messages

Targeting high-profile or important members of an organization

Cloning websites for phishing attacks

Discuss

Answer: (c).Targeting high-profile or important members of an organization Explanation:Whaling in the context of phishing attacks targets high-profile or important members of an organization, such as the CEO or senior vice presidents.

Q29.

What is the main aim of phishing attempts?

Spreading malware

Modifying website code

Persuading targeted individuals to respond

Cloning websites for malicious code injection

Discuss

Answer: (c).Persuading targeted individuals to respond Explanation:The main aim of phishing attempts is to persuade targeted individuals that the message they are receiving is true and real, leading them to respond.

Q30.

What is a watering hole attack in the context of web-based social engineering?

Cloning websites for phishing attacks

Modifying website code to include malware

Capturing data entered on a cloned website

Compromising a commonly visited site and modifying its code

Discuss

Answer: (d).Compromising a commonly visited site and modifying its code Explanation:A watering hole attack involves compromising a commonly visited site and modifying its code to include malware. This attack leverages the behaviors of staff at a target organization.

Page 3 of 7

Planning and Scoping Penetration Tests 🔒

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Exploiting Physical and Social Vulnerabilities MCQs Page

Exploiting Physical and Social Vulnerabilities MCQs | Page 3 of 7

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Penetration Testing

Analyzing Vulnerability Scans

Reporting and Communication

Suggested Topics

Digital Logic Design

Formal Languages and Automata Theory

IT Fundamentals

Hadoop

Cryptography and Network Security

MATLAB

Data Warehousing and OLAP

Discrete Mathematics

UNIX