CEH v13 Social Engineering Practice Questions 2026

Manipulating people: phishing, vishing, pretexting, baiting, tailgating, and building a security-awareness program. Exam focus: name the pretexting family — phishing, spear phishing, vishing, smishing, baiting, tailgating — and the psychological lever it exploits. The exam pairs a short scenario with the technique name; know both directions.

⚠️ Important Disclaimer: These practice questions are original study material created by CEHStudy for educational purposes. They are NOT EC-Council exam questions and do NOT replicate the actual exam. CEHStudy is not affiliated with or endorsed by EC-Council.

Question 1: Phishing conducted over a telephone call is called:

A) Quishing B) Vishing C) Smishing D) Whaling

Answer: B — Vishing = voice phishing; smishing = SMS; quishing = QR codes; whaling targets C-suite executives.

Question 2: Pretexting involves:

A) Poisoning DNS records to redirect traffic B) Leaving an infected USB drive in a parking lot C) Creating a fabricated scenario to make the victim believe a false story, such as impersonating IT support D) Following an employee through a secure door

Answer: C — The attacker researches the target and builds a believable cover story; baiting (USB) and tailgating are separate techniques.

Question 3: Spear phishing differs from mass phishing because it:

A) Requires no social lure whatsoever B) Is only delivered via SMS C) Targets specific individuals using personalized, researched information D) Is sent to millions of addresses at once

Answer: C — Personalization (names, projects, recent events) gathered via OSINT dramatically raises click-through and credential-harvest success.

Question 4: A 'whaling' attack targets:

A) Help-desk technicians B) C-suite executives and senior management C) Print servers and shared folders D) IoT cameras in parking lots

Answer: B — Big fish — CEOs, CFOs — have authority to approve wire transfers and access the most sensitive data.

Question 5: Following an authorized person into a restricted area is called:

A) Pretexting B) Baiting C) Tailgating (piggybacking) D) Dumpster diving

Answer: C — Carrying boxes or acting in a hurry makes it seem the follower belongs — a physical social-engineering staple.

Question 6: Waterholing is when attackers:

A) Compromise websites that their target group frequently visits, delivering malware when targets browse them B) Flood inboxes with spam about water bills C) Send fake invoices to the accounts department D) Clone a bank's login page via DNS poisoning

Answer: A — By contaminating trusted destinations, the attacker reaches many victims at once without individual contact.

Question 7: The 'authority' principle in social engineering exploits people's tendency to:

A) Follow through on past commitments B) Rush decisions under time pressure C) Obey perceived figures of authority such as IT admins or police officers D) Help friends and familiar people

Answer: C — Other levers include scarcity/urgency, familiarity/liking, consistency, and reciprocity — all used to override caution.

Question 8: Phishing via lookalike domains such as microsof.com or company.com.co is an example of:

A) Domain spoofing B) DNS tunneling C) Session fixation D) ARP poisoning

Answer: A — Typosquatted or extra-TLD domains mimic the real brand to fool users into entering credentials on fake login pages.

Question 9: The single most important defense against social engineering is:

A) Hiding the company logo from the web B) Stronger perimeter firewalls C) Ongoing employee training and security awareness D) Disabling email for all staff

Answer: C — Technology can't stop a willing click — trained people who verify requests, simulate-tested regularly, are the real control (plus MFA to limit damage).

Question 10: QR-code phishing ('quishing') works well because:

A) They automatically disable MFA on the phone B) QR codes can't be previewed by email security filters and hide the destination URL until scanned C) They bypass all web application firewalls D) They encrypt the link's contents

Answer: B — Victims never see the URL before scanning — a parking ticket, event pass, or Wi-Fi sign can point anywhere.

Related Glossary Terms

Continue Your CEH v13 Prep

Frequently Asked Questions

How many CEH v13 Social Engineering practice questions are on this page?

This page includes 10 original multiple-choice practice questions for CEH v13 Module 9 (Social Engineering). Each question includes a detailed explanation of the correct answer and why the other options are wrong. The full CEHStudy question bank covers all 20 modules with 200+ questions — see the practice hub at https://cehstudy.com/ceh-practice-questions/ for every module.

What does CEH v13 Module 9 (Social Engineering) cover?

Manipulating people: phishing, vishing, pretexting, baiting, tailgating, and building a security-awareness program. These are the same topics tested under this module on the EC-Council 312-50 exam. Pair this quiz with our free Module 9 flashcards at https://cehstudy.com/ceh-v13/module-09/ to close any gaps.

Are these real CEH exam questions?

No. Every question on CEHStudy is original study material written for exam preparation. They match the style, difficulty, and domain coverage of the actual CEH v13 exam but are not leaked or reproduced EC-Council questions.

How should I use this Social Engineering quiz for exam prep?

Answer all 10 questions without peeking at explanations, then click "Show My Score". Review every explanation — especially the ones you missed — and re-test those topics with our free CEH flashcards. Aim for 80% or higher on module quizzes before scheduling the exam.

Where do I find CEH Social Engineering flashcards?

Our free flashcard app covers all 20 CEH v13 modules including Module 9 (Social Engineering). Visit the CEH flashcards page at https://cehstudy.com/ or the Module 9 page at https://cehstudy.com/ceh-v13/module-09/. No account or sign-up required.

CEH v13 Module 9: Social Engineering — Free Practice Questions with Explanations