mediumMultiple Choice
220-1202 Practice Question: A user receives an email from what appears to be…
A user receives an email from what appears to be their bank, asking them to click a link and verify their account due to suspicious activity. The email contains several spelling errors and the link points to an unfamiliar domain. What type of attack is this?
⚠ Common exam trap
The CompTIA A+ exam often tests the distinction between generic phishing and spear phishing by including a scenario with obvious errors and no personalization, tricking candidates into overthinking and selecting 'spear phishing' because they misidentify the bank context as targeted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phishing
This is a classic phishing attack because the email is a mass, unsolicited message that impersonates a trusted entity (the bank) and uses social engineering to trick the recipient into clicking a malicious link. The presence of spelling errors and an unfamiliar domain are hallmark indicators of a generic phishing attempt, not a targeted attack. Phishing typically relies on volume and deception rather than personalized reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spear phishing
Why it's wrong here
Spear phishing is personalised to a named individual using researched details; this message is a generic, mass-mailed bank lure with spelling errors and an unfamiliar domain. Spear phishing would be correct if the attacker had referenced the recipient's real account details.
- ✓
Phishing
Why this is correct
Phishing uses spoofed sender identity, a fraudulent link to an unfamiliar domain, and poor spelling to trick the recipient into revealing credentials. The bank impersonation plus urgency about suspicious activity matches this social-engineering pattern precisely.
- ✗
Whaling
Why it's wrong here
Whaling targets senior executives through highly tailored, credible messages, so it fails here: the generic mass email with spelling errors and an unfamiliar domain indicates broad phishing, not executive-specific targeting. It would be correct if a fraudster impersonated a CEO to trick a finance director into authorising a large payment.
- ✗
Vishing
Why it's wrong here
Vishing is voice-based social engineering conducted by telephone, whereas this attack arrives as an email containing a malicious link. Vishing would be the answer if the victim received a phone call from someone impersonating the bank's fraud team.
Go deeper
Related to this question
About these practice questions
One of 687 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.