FirstTry

Exam objective

CEH

Social Engineering

This objective sits in Network and Perimeter Hacking, which carries 24% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Network and Perimeter Hacking

An analyst reviewing help desk calls finds a caller repeating details a receptionist gave him an hour earlier and using them to ask for more. What is happening?

Credential stuffing against the help desk web portalReplaying stolen credential pairs is an automated login attack and needs no conversation with a person.
Tailgating through a badge controlled entranceFollowing someone through a controlled door is a physical entry technique, not a telephone one.
Pretexting that chains information across sourcesCorrect · your answerCorrect.
A brute force attempt on the ticketing systemGuessing passwords produces failed authentication events rather than a polite caller quoting real staff names.

Correct.

Checked against cisa.gov, September 2026

Concept

Human attacks build credibility in stages. A small fact learned from one department makes the next request sound routine, and each answer buys a little more trust than the last.

Why C

The caller had nothing at the start and is now quoting internal detail back to staff. Using one department's answers as proof of standing with the next is exactly that staged approach.

Source

An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity.... If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

CISA, Avoiding Social Engineering and Phishing Attacks, checked September 2026
#pretexting#help-desk#information-gathering

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Network and Perimeter Hacking

A finance clerk takes a call whose caller ID shows the company's main line, and the caller asks for a change to payment details. Why is that display weak evidence?

Sample question 2 of 3

Network and Perimeter Hacking

A user reports a text message that contained a shortened link and opened a browser window when tapped. Which form of social engineering is this?

Sample question 3 of 3

Network and Perimeter Hacking

A user forwards a message whose link text reads like the payroll portal, but hovering over it shows a different host. Which indicator has the user found?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network and Perimeter Hacking