200-201 Security Concepts Practice Question
An attacker sends an email that appears to come from the company's IT department, asking the recipient to click a link and reset their password due to a security breach. Which type of social engineering is this?
⚠ Common exam trap
Test-takers frequently confuse 'phishing' with 'spear phishing' because both involve email, but the key differentiator is that spear phishing is targeted and personalized, while the question describes a generic, untargeted email sent to a broad audience.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phishing
B is correct because the attack uses email as the delivery vector to trick the recipient into clicking a malicious link and divulging credentials. This matches the definition of phishing, which is a broad social engineering technique that employs deceptive electronic communications (typically email) to steal sensitive information. The email impersonates the IT department to create a false sense of urgency, a hallmark of phishing campaigns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vishing
Why it's wrong here
Vishing is voice-based social engineering conducted over telephone calls, whereas the scenario describes an email lure with a malicious link. It is tempting because vishing also impersonates IT staff and requests credential or password action; it would be correct if the attacker had phoned the recipient and verbally pressured them to reset credentials.
- ✓
Phishing
Why this is correct
Phishing is a social engineering attack that uses fraudulent email impersonating a trusted entity — here the IT department — to trick recipients into clicking links or disclosing credentials. The spoofed sender and urgent password-reset pretext fit phishing exactly, distinguishing it from vishing, smishing or pretexting.
- ✗
Pretexting
Why it's wrong here
Pretexting is the fabricated scenario or cover story motivating the request, not the delivery channel; here the defining characteristic is the email-borne malicious link. It is tempting because the security-breach story is indeed a pretext; it would be correct if the question asked about the invented narrative used to manipulate the victim.
- ✗
Spear phishing
Why it's wrong here
Spear phishing targets a specific named individual or small group using researched personal details, while this message is a generic IT-department impersonation sent without individual tailoring. It is tempting because the email impersonates a trusted internal function; it would be correct if the attacker had referenced the recipient's role, projects or colleagues.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.