Information Security Social Engineering Quiz

A social engineering technique where an attacker pretends to be an attractive person online to build a fake relationship and extract confidential information from the target.

An attacker creates a fake profile on a social media platform to trick someone into sharing company information.

A malicious technique where attackers use deceptive tactics to entice users into giving up sensitive information or accessing malicious files.

An attack where an attacker disguises their identity to gain unauthorized access to a system or network.

A social engineering technique where attackers offer something tempting (like a USB drive with enticing information) to trick users into revealing data or downloading malware.

A method of obtaining confidential information by targeting an insider who has access to critical data.

A fake USB drive, often labeled with company information to trick people into accessing malicious content.

A type of spoofing attack to gain unauthorized access to a network or system.

A type of cryptography where the same key is used for both encryption and decryption.

A type of cryptography where two separate keys are used: one for encryption and another for decryption.

A protocol used for secure communication over the internet, combining both symmetric and asymmetric cryptography to establish secure connections between a client and a server.

An attack that exploits the vulnerabilities in a system's security to gain unauthorized access or manipulate data.

The expected financial loss from a single security incident.

The likelihood of a security incident occurring within a specific timeframe.

The expected financial loss from a security incident over a year.

A type of attack where the attacker intercepts the communication between two parties and replaces the legitimate messages with their own.

A type of attack where an attacker tries every word in a dictionary as a password to gain access to a system.

An attack where an attacker captures data transmitted between devices and then replays it later to gain unauthorized access.

A type of attack where an attacker intercepts and analyzes data transmitted between devices to understand how they communicate and potentially exploit vulnerabilities.

A type of attack where an attacker gathers information about a target system or network before launching a full-fledged attack.

A technique used to crack encrypted messages or passwords by analyzing the patterns and algorithms used in the encryption process.

Information that can be used to identify an individual, including names, dates (excluding year), phone numbers, addresses, Social Security numbers, email addresses, etc.

A program where companies allow independent security researchers to report vulnerabilities and receive rewards for their findings.

The HIPAA Privacy Rule applies to PHI, limiting its use and disclosure. It requires companies to protect this data and make sure it's kept confidential.

The HIPAA Security Rule requires companies to implement technical, physical and administrative safeguards to protect PHI.

A specific variety of code or feature that uniquely differentiates a healthcare provider or organization, can also be considered PHI.

Includes retinal scans, fingerprints, and other unique biometric information.

A specific type of vulnerability disclosure program where companies incentivize ethical hackers to identify security weaknesses in their systems by offering financial rewards.

Platforms like HackerOne and Bugcrowd facilitate bug bounty programs. They provide a platform for researchers to report vulnerabilities.

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that protects sensitive patient health information (PHI). It sets standards for securing, using, and disclosing PHI.

Protected Health Information (PHI) is any individually identifiable health information that is used, maintained, stored, or transmitted by a healthcare provider, health plan, or healthcare clearinghouse.

A HIPAA-covered entity is any healthcare provider, health plan, or healthcare clearinghouse that handles PHI.

A business associate of a HIPAA-covered entity is any organization that provides services to a covered entity that involve the use or disclosure of PHI.

A breach of HIPAA is any unauthorized use or disclosure of PHI. This can involve data theft, hacking, or other security vulnerabilities.

The HIPAA Enforcement Rule specifies how HIPAA violations are investigated and penalized. It outlines different penalties based on the severity of the violation.

Corporations use bug bounty programs to leverage a diverse pool of ethical hackers to find and report security vulnerabilities in their software and systems.

Bug bounty programs offer ethical hackers financial rewards, recognition, and opportunities to showcase their skills, making it a motivating and valuable platform for security research.

Bug bounty programs are often flooded with participants, which can lead to fierce competition and the risk of finding a bug that has already been reported, leaving you with no reward.

A bug bounty program acts as a public signal to stakeholders that a company is serious about its cybersecurity posture, fostering trust and confidence.

Bug bounty programs allow companies to access a wider range of security expertise than they could with their in-house team.

The increasing popularity and adoption of bug bounty programs have led to them being seen as a standard practice within the security industry.

Bug bounty programs often require hackers to be the first to report a bug to receive rewards. Finding a bug that is already reported by someone else can be a frustrating experience for participants.

While some hackers make a full-time income through bug bounty programs, the majority of participants do not earn significant amounts, with only a small percentage actually receiving rewards.