Free Social Engineering practice questions
10 free SY0-801 questions on Social Engineering, each with a full explanation — no account needed. This section sits in the Threats, Vulnerabilities, and Attacks part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
An attacker studies a hospital research team's conference talks and grant announcements, then emails four of its lab managers a message that cites their real grant program and links to "updated funding forms" behind a sign-in page. Which attack is this?
A lure built from research about a specific small group, naming their real program, is spear phishing. Lab managers aren't senior executives, so it isn't whaling, and generic phishing sends one message to large numbers of people. Business email compromise impersonates an executive or supplier to redirect money or data, while this message harvests credentials through a link.
A user hovers over the button in a suspicious email and sees the destination login.example.com.secure-mail-check.net/owa. The company's real domain is example.com. Which domain does the attacker control?
Domain names are read from the right: the top-level domain is .net, and the registered name immediately to its left is secure-mail-check, so the attacker owns secure-mail-check.net. The example.com text near the start is only a subdomain label the attacker created to look familiar, and mail-check.net isn't a domain in the address at all.
An analyst reviews a suspected phish whose From address uses the company's own domain. The Authentication-Results header shows spf=fail, dkim=none and dmarc=fail, yet the message still reached inboxes. What BEST explains why it was delivered?
A DMARC policy of p=none asks receiving servers to report failures rather than quarantine or reject the message, so a forged message that fails every check can still be delivered. The header itself rules out an authorized SPF sender and a valid DKIM signature, and a missing DKIM signature doesn't cause SPF failures to be ignored.
A message to staff reads: "Most of your department has already enrolled in the new expense app. Sign in below to join them." Which social engineering principle does it rely on MOST?
Claiming that others have already complied is consensus, which pressures the reader to follow the crowd. Scarcity offers something in limited supply, authority claims to come from someone the victim must obey, and urgency imposes a deadline, and the message does none of these.
Several employees entered their passwords and one-time codes on a relay phishing page that passed both through to the real sign-in service and kept the session cookie it returned. Which control would BEST prevent this from working?
FIDO2 keys and passkeys bind each credential to the real site's domain, so the browser and authenticator won't use it on a lookalike relay page. SMS codes can be relayed just like app codes, a longer password is still typed into the fake page, and modern lures are often well written, so spelling filters miss them.
An employee receives what looks like a shared-document notice and suspects it is phishing. What should she do with the message?
Reporting through the official channel lets analysts confirm the message, find every recipient and contain it. Replying can reach the attacker, forwarding spreads the lure to more people, and quietly deleting it hides an attack that others in the company may already have fallen for.
A text claiming to be from a delivery company says its tracking link will start working once the recipient replies Y. Why does the attacker want that reply?
Some messaging apps keep links from unknown senders inactive until the recipient replies, so asking for a reply is an attempt to switch that protection off. A reply doesn't verify the sender to the carrier, doesn't install anything, and tells the attacker the number is live rather than stopping further texts.
A user's inbox is suddenly flooded with thousands of newsletter sign-up emails. Soon after, a caller claiming to be the help desk offers to fix the problem and asks the user to start Quick Assist and share control of the screen. What should the user do?
Flooding an inbox and then calling as the help desk is a known vishing pattern, and calling the help desk back on a number you already had takes the channel away from the attacker. The caller knew about the flood because the caller caused it, an employee ID is easy for an attacker to find, and sending anything to the caller keeps the conversation on the attacker's channel.
A caller whose caller ID shows a bank's real fraud-line number asks a customer to read back the code that was just texted to her. Why shouldn't the caller ID reassure her?
Caller ID is information the calling system supplies, so it can be forged to show a bank's real number, and a code requested by the caller would authorize the attacker's own login or transfer. STIR/SHAKEN coverage is incomplete, so it doesn't block every spoofed call, and the claims about email-only banks and carrier-only numbers aren't true.
An email that appears to come from HR asks staff to scan a QR code with their phones to review a mandatory benefits update. Which attack is this, and why does it often get past the mail filter?
A QR code in an email is quishing: the link is carried inside an image that text-based link scanners miss, and the scan happens on a personal phone outside corporate filtering. The message arrived by email rather than text, scanning opens a web page rather than placing a call, and it was sent to all staff rather than to executives.
Study this section
Every lesson that covers Social Engineering on the SY0-801 exam.