Social Engineering Exam Questions

• D Shoulder surfing (1)
• The only correct answer is D. The correct answer is shoulder surfing.
• A is not correct because baiting tempts a user with something attractive, such as a free gift
• B is not correct because blagging obtains information by deceiving someone, often by phone or in person
• C is not correct because phishing sends fake messages to trick a user into giving information

• B Phishing (1)
• The only correct answer is B. The correct answer is phishing.
• A is not correct because baiting tempts a user with something attractive, such as a free prize
• C is not correct because pretexting uses a made-up story or a false identity to gain a user's trust
• D is not correct because vishing is carried out using a phone call, not an email

• A Baiting (1)
• The only correct answer is A. The correct answer is baiting.
• B is not correct because blagging (pretexting) obtains information by deceiving someone
• C is not correct because shoulder surfing is watching someone enter their information
• D is not correct because scareware frightens a user with a fake warning

• B Asking people for confidential information (1)
• The only correct answer is B. The correct answer is asking people for confidential information.
• A is not correct because exploiting unpatched software is hackers using vulnerabilities in software, not social engineering
• C is not correct because recording key presses using malware is a key logger, a type of malware
• D is not correct because installing ransomware is malware that encrypts files and demands payment

Award one mark for any of the following up to a maximum of two marks:

• Obtaining/gaining confidential/personal information (1)
• By asking/tricking/deceiving/manipulating people/users (1)
• Exploiting human trust/weakness (1)
• Pretending/impersonating a person or organisation to get information (1)

Allow 'people' or 'users' as equivalent.

Allow 'using people to get information' where it shows that information is obtained from a person.

Do not accept answers that only name a method of social engineering, e.g. phishing, shoulder surfing.

Do not accept hacking a computer, installing malware or other technical attacks.

Award one mark for any of the following up to a maximum of two marks:

• Looking/leaning/watching over someone's shoulder (to see their screen/keypad) (1)
• Using a CCTV camera to view a screen/keypad (1)
• Filming/photographing a screen/keypad with a mobile phone/camera (1)
• Using binoculars to view a screen/keypad (1)
• Standing close to someone at an ATM/cash machine to see their PIN (1)

Do not accept phishing.

Do not accept guessing a password.

Award one mark for any of the following up to a maximum of two marks:

• Sending messages (emails/texts/phone calls) to users (1)
• Pretending to be from a trusted organisation/person, e.g. a bank (1)
• To trick the recipient into giving personal/confidential information (1)
• Directing the user to a fake website (1)

Do not accept 'a virus/software that steals data'.

Award one mark for any of the following up to a maximum of two marks:

• Phishing (1)
• Shoulder surfing (1)
• Blagging/pretexting (1)
• Baiting (1)
• Scareware (1)
• Quid pro quo (1)
• Vishing/spear phishing (1)

Allow tailgating/piggybacking, impersonation or pharming as creditworthy methods.

Allow scareware as a social engineering method.

Do not award both phishing and spear phishing/vishing in the same answer; award a maximum of one mark for these combined.

Do not accept hacking, malware, brute force attack, firewall or authentication.

Award up to two marks for a linked description such as:

• Obtaining/gaining confidential/personal information (such as passwords/usernames/bank details) (1) by manipulating/tricking a person into providing it (1)
• Pretending to be a trusted person/organisation (1) to persuade a user to reveal information (1)
• Exploiting human trust (1) to persuade a person to reveal information/give access to a system (1)
• Using psychological/confidence tricks (1) to get a person to break normal security procedures (1)

Allow impersonation (pretending to be a trusted person/organisation) as the linked development of the first bullet, e.g. tricking a user by pretending to be from their bank (1) to obtain their login details (1).

Do not accept naming a social engineering technique (phishing/shoulder surfing/blagging) without describing how a person is manipulated/tricked.

Do not accept responses that describe a technical attack, such as installing malware or guessing passwords, without tricking a person.

Do not accept 'it is an attack on people/users' with no method of obtaining the information.

Award up to two marks for a linked description such as:

• Watching someone as they type in a password/PIN (1) to then log in to their account/system (1)
• Using a camera/CCTV to record someone entering their credentials/login details (1) so the recording reveals the password/PIN to the attacker (1)
• Observing a person entering personal details/data (1) to use those details to gain access to the system/pass a security check (1)

Do not accept just 'looking over someone's shoulder' or 'watching the screen' without saying which information is gained (password/PIN/login details/personal data) or how it is used.

Do not accept descriptions of other social engineering methods/techniques, such as phishing, or generic answers about hacking/malware.

Award up to two marks for a linked description such as:

• Sends an email/text message pretending to be from a trusted organisation/bank (1) asking the user to confirm/provide personal details/login details (1)
• Includes a link to a fake website (1) where the user enters their login details/personal information (1)
• Sends a message claiming there is a problem with the user's account (1) so the user replies with their personal information (1)

Allow 'email/text message/SMS' for 'email/text message'.

Allow 'bank/company/organisation' for 'trusted organisation'.

Allow 'username and password/login details/personal details' for 'personal details/login details'.

Do not award a mark for 'sends an email' on its own, with no deception or request for information.

Do not award a second mark for 'sends a fake email' that does not say how the personal information is obtained.

Do not award descriptions that only involve malware (e.g. a keylogger or Trojan) or a malicious website, with no deceptive message to the user.

Do not accept descriptions of other social engineering methods, such as shoulder surfing.

Award up to two marks for a linked description such as:

• Tricks a legitimate user/employee into revealing their login details/credentials (1) so the attacker can use the account to access the system/data (1)
• Exploits human trust/error (1) so technical security measures such as firewalls/passwords can be bypassed (1)
• Convinces a user that a message/website is genuine/is from a trusted organisation (1) so the user gives away confidential information/data (1)
• Gets a user to follow a link/open an attachment (1) so malware is installed on the system (1)

Allow 'deceives/manipulates/persuades a user' as the human-factor mechanism.

For the second mark, the development must give a consequence beyond the trick itself, such as access to the system/data or bypassed security.

Do not award generic statements such as 'it steals data', 'it causes harm' or 'it hacks the system' that do not name the human-factor mechanism.

Do not accept answers that only name a social engineering method, such as phishing, without saying how it threatens the system.

Do not accept answers about malware or technical attacks, such as a virus deleting files.

Award up to two marks for a linked explanation such as:

• The attacker targets people/users rather than the technology (1) because users can be tricked/persuaded into giving confidential information/access (1)
• The attacker does not need to bypass/circumvent the technical security (1) because a user can be tricked into giving them the password/details/access (1)
• The attacker can pretend to be a trusted person/organisation (1) so the user believes the request is genuine and gives information/access (1)
• The attacker can contact many employees at once (1) so is more likely to find someone who believes the message and gives information/access (1)

A point on its own can earn one mark; the second mark requires a linked reason.

For both marks, the expansion must follow/associate with the statement.

Do not accept 'people are the weakest link' on its own without saying why/how users can be exploited.

Do not accept answers that only restate that social engineering targets people without a reason.

Do not accept 'users make mistakes' without saying how an attacker exploits this to get information/access.

Do not accept naming a social engineering method, such as phishing or pretexting, without a linked reason why it succeeds.

Do not award marks for answers about technical vulnerabilities such as an out-of-date firewall, out-of-date anti-malware or unpatched software, as these are not social engineering.

Do not award the same reason twice, e.g. 'the user is tricked' can only support one point.

Award up to two marks for a linked explanation such as:

• (The attacker) watches/observes the user (1) as they type in their password/PIN (1)
• (The attacker) uses a camera/CCTV to record/film the user (1) as they type in their password/PIN (1)
• (The attacker) looks at the user's screen (1) and sees their password/account details (1)
• (The attacker) obtains the user's password/PIN by watching/observing them (1) so they can log in to the user's account (1)
• (The attacker) stands close to the user in a public place (1) so they can watch them type in their password/PIN (1)

For both marks, the expansion must follow/associate with the statement.

The first mark is for the attacker watching/recording the user, or looking at their screen. The second mark is for naming what is obtained (a password/PIN or other information that is typed/displayed) or for how it is then used, e.g. to log in to the user's account.

Allow the first mark for watching/recording the user, or looking at their screen, even when the answer does not state what is typed or displayed.

Allow the second mark where the answer says what information is seen; the answer does not have to go on to describe the attack itself, e.g. logging in to an account.

Do not accept 'shoulder surfing' or 'looking over someone's shoulder' on its own, with no password/PIN or other information seen, as this repeats the question.

Do not accept 'the attacker steals/gets the password' without saying that it was obtained by watching/observing the user.

Do not accept other social engineering methods, such as phishing or baiting, that do not involve observing the user.

Award up to two marks for a linked explanation such as:

• The email appears to come from a genuine/trusted organisation (1) so the user believes the request is real (1)
• The email contains a link to a fake website (1) where the user types their username/password, which the attacker then captures (1)
• The email asks the user to confirm/update their login details (1) so the user sends/supplies them to the attacker (1)
• The email warns of a problem with the account/creates a sense of urgency (1) so the user acts without checking and enters their details (1)

For both marks, the expansion must follow/associate with the statement.

A point without a linked reason earns one mark only.

Accept a forged/spoofed sender address as part of the first point only, provided it is linked to the user trusting the email and giving their details.

Do not accept 'the user is tricked' or 'the email looks real' on its own, without saying what the user then does with their details.

Do not accept 'the email has a virus' as the explanation, as this describes malware rather than phishing.

Do not accept answers where the attacker guesses/cracks/brute forces the password, as phishing involves the user giving the details themselves.

Award up to two marks for a linked explanation such as:

• It requires less technical skill/knowledge (1) because the attacker tricks/asks the user rather than writing code/finding a flaw (1)
• It can be cheaper/quicker (1) because no specialist software/tools are needed (1)
• It is more likely to succeed (1) because users are trusting and give the information willingly (1)
• There may be no known technical vulnerability to exploit (1) so tricking a user is the easier route in (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'it is easier' on its own without saying why it is easier, such as no technical skill being needed.

Do not award marks for answers that describe finding or using an unpatched software vulnerability, as this is not social engineering.

Indicative content

Methods an attacker could use

• A phishing email, like the fake IT team message, can lead staff to a fake login page where their username and password are captured.
• Spear phishing could target one named member of staff, such as the receptionist, using details taken from the hospital's website.
• Shoulder surfing at the shared reception computer lets an attacker watch a password being typed, or use a camera to record it.
• Blagging or pretexting can be used to phone reception and pretend to be a manager or an engineer in order to obtain information.
• Baiting can involve leaving a USB drive in the staff room for someone to plug in, or offering a free download that installs malware.
• Scareware can show a pop-up claiming the computer has a virus and invite staff to follow a link or pay for a fake fix.

Why hospital staff might be vulnerable

• Staff are busy and may follow the link without checking the sender address of the email.
• The message appears to come from the IT team, so staff trust it as an official request and do not question it.
• Staff may not have had recent training, so they do not recognise a fake login page.
• The shared reception computer is in a public area, so other people can see the screen or watch the keyboard.
• Staff want to help a caller who says there is an urgent problem, so they give information without checking who the caller is.

The impact on the hospital if an attack succeeds

• The attacker could use the stolen login to open patient records and steal sensitive data.
• The attacker could change or delete records, so treatment decisions are based on wrong information.
• The hospital may disconnect its systems to contain the attack, delaying appointments and treatment.
• The hospital could face a penalty under data protection legislation and lose the trust of its patients.
• The attacker could install malware to keep access to the network for later attacks.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)
• Level 3 responses must cover methods, why staff might be vulnerable and the impact, applying each to the hospital; an answer that only names methods, or names them without applying them to the hospital, is limited to Level 1.
• Do not accept malware infection (for example a virus arriving in an email attachment) on its own as a social engineering method, but do accept malware being installed as a result of a social engineering attack as an impact.

Indicative content

Staff training

• Training teachers to recognise fake IT support calls, such as calls asking for a password, helps them spot the social engineering attack before they give information away.
• Staff should be told to check any request by calling IT back on a number they already know, rather than using a number supplied by the caller, so a fake caller cannot redirect them.
• Regular refresher training keeps staff aware of new social engineering methods, such as phishing emails or pretexting calls, and is low cost for a school with a limited budget.
• Training should make clear that passwords must never be shared, even with someone who claims to be IT support, because IT does not need a teacher's password.
• Training alone is not enough because staff can still be tricked, so it should be combined with technical measures and clear policies.

Technical measures

• Multi-factor authentication makes a stolen password less useful, because the attacker also needs a second code or device to log in to the student records system.
• Multi-factor authentication may cost money, so the school could apply it first to the student records system, where the data is most sensitive.
• Filtering emails and blocking known fake websites can stop some phishing messages reaching teachers, but it cannot stop phone calls.
• Screen locks and privacy filters reduce the risk of shoulder surfing when teachers use laptops in classrooms or shared areas.
• Keeping anti-malware up to date can help detect malware delivered by a phishing link, but it does not stop a teacher being tricked into giving away a password.

Policies and procedures

• A policy stating that IT support will never ask for a password gives teachers a clear rule and makes a fake call easier to recognise.
• A simple reporting procedure for suspicious calls and emails lets the school warn other staff quickly and investigate the attack.
• Limiting access to student records means a stolen teacher account cannot see all the data, reducing the impact if social engineering succeeds.
• Simulated phishing messages can test staff and identify who needs further training, although this takes time to run.
• Clear policies and training are low-cost measures that suit the school's limited budget, while technical measures can be added where they protect the most sensitive data.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)
• Level 3 responses must cover staff training, technical measures and policies or procedures, develop at least two measures by explaining how they reduce the threat, and draw the measures together; a list of undeveloped measures, even across all three areas, is limited to Level 2.
• A response with only one or two basic measures and little or no explanation is Level 1. Do not accept installing antivirus or a firewall on its own as a measure against social engineering; anti-malware can be credited only where it is linked to detecting malware delivered by a phishing attack.