Phishing and social engineering in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Phishing Techniques

Which of the following best describes a common method used in phishing attacks?

A Physically breaking into a building to steal computers

B Using software to scan for open Wi-Fi networks

C Sending an email that appears to be from a trusted source asking for personal information

D Installing antivirus software on a computer

💡 Hint

Think about how attackers trick people into giving away sensitive data.

Phishing commonly involves sending fake emails that look real to trick people into sharing personal information.

📋 Factual

intermediate

Identifying Social Engineering Examples

Which of the following is an example of social engineering?

A A hacker exploiting a software vulnerability to gain access

B An attacker calling an employee pretending to be IT support to get their password

C Using a brute force attack to guess a password

D Installing malware through a malicious website

💡 Hint

Social engineering involves manipulating people rather than technology.

Social engineering tricks people into giving information, like pretending to be IT support to get passwords.

🔍 Analysis

advanced

Analyzing Phishing Email Characteristics

Which feature in an email is most likely a sign of a phishing attempt?

A An email with urgent language asking to verify account details via a suspicious link

B An email confirming a recent purchase you made

C An email from a known contact with a personalized greeting

D An email with proper grammar and no links

💡 Hint

Phishing emails often try to create a sense of urgency and ask for sensitive info.

Urgent requests with suspicious links asking for account verification are common phishing signs.

❓ Comparison

advanced

Comparing Phishing and Spear Phishing

What is the main difference between phishing and spear phishing attacks?

A Phishing requires malware; spear phishing does not

B Phishing uses phone calls; spear phishing uses emails only

C Phishing is legal; spear phishing is illegal

D Phishing targets many people broadly; spear phishing targets specific individuals or organizations

💡 Hint

Consider how attackers choose their victims in each case.

Phishing casts a wide net, while spear phishing is a focused attack on specific targets.

❓ Reasoning

expert

Evaluating Defense Strategies Against Social Engineering

Which defense strategy is most effective in reducing the risk of social engineering attacks?

A Training employees to recognize and report suspicious requests

B Regularly updating software to patch vulnerabilities

C Installing firewalls to block unauthorized network access

D Using strong passwords for all accounts

💡 Hint

Think about how social engineering exploits human behavior.

Training people to spot and report suspicious behavior helps prevent social engineering attacks effectively.

Practice

1. What is the main goal of a phishing attack?

easy

A. To trick people into giving personal information

B. To physically steal a computer

C. To improve internet speed

D. To update software automatically

Solution

1. Step 1: Understand phishing purpose

   Phishing attacks use fake messages to deceive people.

2. Step 2: Identify the attack goal

   The goal is to steal personal or sensitive information by tricking users.

3. Final Answer:

   To trick people into giving personal information -> Option A

4. Quick Check:

   Phishing = stealing info by tricking [OK]

Hint: Phishing steals info by fake messages [OK]

Common Mistakes:

• Confusing phishing with physical theft
• Thinking phishing improves technology
• Believing phishing updates software

2. Which of the following is a common sign of a phishing email?

easy

A. An email asking for your password urgently

B. An email from a known contact with no links

C. A newsletter you subscribed to

D. A system update notification from your computer

Solution

1. Step 1: Identify phishing email traits

   Phishing emails often create urgency and ask for sensitive info like passwords.

2. Step 2: Match the option to phishing signs

   An email asking for your password urgently shows urgency and password request, a common phishing tactic.

3. Final Answer:

   An email asking for your password urgently -> Option A

4. Quick Check:

   Urgent password request = phishing sign [OK]

Hint: Urgent password requests often mean phishing [OK]

Common Mistakes:

• Thinking all emails from contacts are safe
• Confusing newsletters with phishing
• Assuming system updates ask for passwords

3. Consider this message: "Your account will be locked in 24 hours. Click here to verify." What is the most likely purpose of this message?

medium

A. To warn about a real account issue

B. To update account settings securely

C. To steal login details through a fake link

D. To provide customer support contact

Solution

1. Step 1: Analyze message content

   The message creates urgency and includes a suspicious link.

2. Step 2: Identify phishing behavior

   Fake links are used to steal login details by tricking users.

3. Final Answer:

   To steal login details through a fake link -> Option C

4. Quick Check:

   Urgency + fake link = phishing attempt [OK]

Hint: Urgent messages with links often steal info [OK]

Common Mistakes:

• Believing all urgent messages are real
• Clicking links without checking URL
• Assuming links always lead to safe sites

4. You receive an email that looks like it's from your bank but the sender's address is [e-mail]. What is the best action to take?

medium

A. Reply asking for more details

B. Verify the sender's address and contact the bank directly

C. Click the link to check your account immediately

D. Forward the email to friends to warn them

Solution

1. Step 1: Check sender's email carefully

   The sender's address looks suspicious and not official.

2. Step 2: Choose safe verification method

   Contacting the bank directly using official channels avoids phishing risks.

3. Final Answer:

   Verify the sender's address and contact the bank directly -> Option B

4. Quick Check:

   Verify sender + direct contact = safe action [OK]

Hint: Always verify sender and contact official source [OK]

Common Mistakes:

• Clicking suspicious links immediately
• Replying to unknown senders
• Sharing suspicious emails without checking

5. A social engineer tries to gain access to a company by pretending to be a trusted delivery person. Which of the following is the best way to prevent this type of attack?

hard

A. Share passwords with delivery staff for convenience

B. Allow anyone with a delivery badge inside

C. Ignore all visitors to avoid risk

D. Verify identity and delivery details before granting access

Solution

1. Step 1: Understand social engineering tactics

   Attackers use trust and fake identities to gain access.

2. Step 2: Identify proper security response

   Verifying identity and delivery details prevents unauthorized entry.

3. Final Answer:

   Verify identity and delivery details before granting access -> Option D

4. Quick Check:

   Verify identity = prevent social engineering [OK]

Hint: Always verify before trusting visitors inside [OK]

Common Mistakes:

• Trusting anyone with a badge
• Ignoring visitors completely
• Sharing sensitive info with outsiders