Social engineering and threats: phishing, vishing, smishing, QR code phishing, whaling, impersonation, tailgating, shoulder surfing, dumpster diving, evil twin, DoS/DDoS, zero-day, on-path, brute force, insider threat, SQL injection, XSS, BEC, supply chain

Social engineering manipulates people rather than technology, exploiting trust, urgency, fear, curiosity and the wish to be helpful. It is often the easiest way into an organization, so the best defenses are training, verification procedures and a culture where it is safe to say no or to double-check. The exam lists many threat names; your job is to recognize each from a short description and pick the control that reduces it.