Social engineering awareness in Intro to Computing - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identifying Social Engineering Techniques

Which of the following is NOT a common social engineering technique?

A Using a brute force attack to guess passwords

B Pretexting by pretending to be someone trustworthy

C Phishing emails that trick users into revealing passwords

D Tailgating to gain physical access to restricted areas

💡 Hint

Think about whether the technique involves manipulating people or computers.

Brute force attacks target computer systems directly, not people. Social engineering relies on tricking people.

❓ trace

intermediate

Trace the Outcome of a Phishing Email Scenario

Imagine a user receives an email asking to reset their password by clicking a link. The link leads to a fake website. What is the most likely outcome if the user enters their password?

A The password is safely updated on the real website

B The password is stolen by attackers through the fake website

C The user receives a confirmation email from their company

D The user's computer automatically blocks the fake website

💡 Hint

Consider what happens when you enter sensitive info on a fake site.

Entering the password on a fake site sends it directly to attackers, compromising security.

❓ identification

advanced

Identify the Red Flags in a Social Engineering Call

A caller claims to be from IT support and asks for your login details to fix an urgent problem. Which of these is a red flag indicating a social engineering attempt?

A The caller uses your real name and department

B The caller provides a company phone number

C The caller offers to send a follow-up email

D The caller insists on immediate action without verification

💡 Hint

Think about what trustworthy support staff would or wouldn't do.

Legitimate IT support never asks for passwords or forces immediate action without verification.

❓ Comparison

advanced

Compare Social Engineering and Technical Hacking

Which statement best explains the difference between social engineering and technical hacking?

A Both rely only on guessing passwords without user interaction

B Social engineering targets software vulnerabilities; technical hacking targets people

C Social engineering tricks people to gain access; technical hacking exploits computer weaknesses

D Technical hacking uses phone calls; social engineering uses malware

💡 Hint

Think about who or what each method tries to fool or attack.

Social engineering manipulates people, while technical hacking attacks systems directly.

🚀 Application

expert

Designing a Defense Against Social Engineering

You are tasked with improving your company's defense against social engineering attacks. Which of the following measures is most effective?

A Training employees to recognize and report suspicious requests

B Blocking all emails from unknown senders

C Using complex passwords that change monthly

D Installing the latest antivirus software on all computers

💡 Hint

Consider what helps people avoid being tricked.

Employee training empowers people to spot and stop social engineering attempts, which target human behavior.

Practice

1. What is the main goal of social engineering in computing?

easy

A. To trick people into giving private information

B. To hack computer software directly

C. To improve computer speed

D. To update antivirus software

Solution

1. Step 1: Understand social engineering basics

   Social engineering targets human behavior, not computer systems.

2. Step 2: Identify the goal of social engineering

   The goal is to trick people into revealing private or sensitive information.

3. Final Answer:

   To trick people into giving private information -> Option A

4. Quick Check:

   Social engineering = trick people [OK]

Hint: Social engineering targets people, not machines [OK]

Common Mistakes:

• Thinking it hacks software directly
• Confusing with computer viruses
• Assuming it improves hardware

2. Which of the following is a safe practice when receiving an unexpected email asking for your password?

easy

A. Verify the sender's identity before responding

B. Click the link in the email to update your password

C. Reply with your password immediately

D. Forward the email to all your contacts

Solution

1. Step 1: Analyze email safety steps

   Never share passwords or click links without verifying the sender.

2. Step 2: Choose the safest action

   Verifying the sender's identity helps avoid falling for scams.

3. Final Answer:

   Verify the sender's identity before responding -> Option A

4. Quick Check:

   Verify sender before sharing info [OK]

Hint: Always verify who asks before sharing info [OK]

Common Mistakes:

• Sharing passwords without checking
• Clicking suspicious links
• Forwarding suspicious emails

3. You receive a phone call from someone claiming to be from your bank asking for your account number. What should you do?

medium

A. Give the account number immediately to avoid problems

B. Ask the caller to send an email instead

C. Share your account number only if the caller sounds polite

D. Hang up and call the bank using the official number

Solution

1. Step 1: Identify safe response to suspicious calls

   Never share sensitive info over unexpected calls without verification.

2. Step 2: Verify caller by contacting bank directly

   Calling the bank using official contact ensures legitimacy.

3. Final Answer:

   Hang up and call the bank using the official number -> Option D

4. Quick Check:

   Verify caller by official contact [OK]

Hint: Always verify caller by official number [OK]

Common Mistakes:

• Sharing info immediately
• Trusting caller tone
• Asking for email instead (may delay but not verify)

4. Identify the mistake in this scenario: A user receives an email asking to reset their password and clicks the link without checking the sender's email address.

medium

A. The user correctly reset the password

B. The user should have checked the sender's email address first

C. The user should have replied to the email

D. The user should have forwarded the email to IT support

Solution

1. Step 1: Analyze the user's action

   Clicking links without verifying sender can lead to phishing attacks.

2. Step 2: Identify the correct safe practice

   Checking the sender's email address helps confirm if the email is legitimate.

3. Final Answer:

   The user should have checked the sender's email address first -> Option B

4. Quick Check:

   Verify sender before clicking links [OK]

Hint: Check sender email before clicking links [OK]

Common Mistakes:

• Assuming all password reset emails are safe
• Replying to suspicious emails
• Forwarding without verifying

5. A company wants to train employees to avoid social engineering attacks. Which combination of actions is best to include in the training?

hard

A. Share passwords only with managers and never change them

B. Ignore all emails and calls from unknown sources

C. Verify identity before sharing info and report suspicious messages

D. Click links quickly to avoid delays and trust polite callers

Solution

1. Step 1: Evaluate safe practices for social engineering prevention

   Ignoring all unknown contacts is impractical; sharing passwords or clicking links quickly is unsafe.

2. Step 2: Identify best training actions

   Verifying identity before sharing info and reporting suspicious messages helps prevent attacks effectively.

3. Final Answer:

   Verify identity before sharing info and report suspicious messages -> Option C

4. Quick Check:

   Verify and report suspicious = safe training [OK]

Hint: Verify identity and report suspicious contacts [OK]

Common Mistakes:

• Ignoring all unknown contacts
• Sharing passwords without checks
• Trusting callers based on tone