nerdexam
EC-Council

312-50V13 · Question #240

While browsing his Facebook teed, Matt sees a picture one of his friends posted with the caption. "Learn more about your friends!", as well as a number of personal questions. Matt is suspicious and…

The correct answer is A. Matt inadvertently provided the answers to his security questions when responding to the post. Matt unwittingly provided answers to common security questions through the Facebook post, which allowed an attacker to reset or gain access to his bank account.

Submitted by marco_it· Mar 6, 2026Social Engineering

Question

While browsing his Facebook teed, Matt sees a picture one of his friends posted with the caption. "Learn more about your friends!", as well as a number of personal questions. Matt is suspicious and texts his friend, who confirms that he did indeed post it. With assurance that the post is legitimate. Matt responds to the questions on the post, a few days later. Mates bank account has been accessed, and the password has been changed. What most likely happened?

Options

  • AMatt inadvertently provided the answers to his security questions when responding to the post.
  • BMatt's bank-account login information was brute forced.
  • CMatt Inadvertently provided his password when responding to the post.
  • DMatt's computer was infected with a keylogger.

How the community answered

(23 responses)
  • A
    74% (17)
  • B
    13% (3)
  • C
    4% (1)
  • D
    9% (2)

Why each option

Matt unwittingly provided answers to common security questions through the Facebook post, which allowed an attacker to reset or gain access to his bank account.

AMatt inadvertently provided the answers to his security questions when responding to the post.Correct

Many online services use security questions (e.g., 'What was your first pet's name?', 'What is your mother's maiden name?') as a method for account recovery or password resets. By answering personal questions publicly on Facebook, Matt likely supplied the exact information an attacker needed to bypass the security questions on his bank account and change the password.

BMatt's bank-account login information was brute forced.

Brute-forcing bank account login information is generally computationally intensive and unlikely to succeed quickly, especially if the account has lockout mechanisms, and it doesn't align with the information gathering method described.

CMatt Inadvertently provided his password when responding to the post.

The questions described are personal information, not direct password requests; it's highly improbable Matt would directly provide his bank password in response to "Learn more about your friends!" questions.

DMatt's computer was infected with a keylogger.

While a keylogger could steal credentials, the scenario explicitly describes Matt providing information via a public post, and his friend confirming the post, suggesting information harvesting rather than a malware infection on Matt's computer as the primary vector.

Concept tested: Social engineering; security questions vulnerability

Source: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/04-Authentication_Testing/05-Testing_for_Weak_Security_Question_Answer_Generation_or_Processing.html

Topics

#social engineering#security questions#information disclosure#phishing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice