220-1102 Security Practice Question
A technician receives a phone call from someone claiming to be from the company's help desk. The caller states there is a problem with the technician's account and asks for the technician's username and password to 'run a test'. Which type of social engineering attack is this?
⚠ Common exam trap
Test-takers frequently confuse the delivery method (voice call) with the attack type, choosing 'Vishing' instead of recognizing that the core social engineering technique is the fabricated pretext, which defines pretexting regardless of the communication channel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pretexting
This is a classic pretexting attack because the caller fabricates a scenario (claiming to be from the help desk and needing to 'run a test') to trick the technician into revealing sensitive credentials. Pretexting relies on creating a false identity or story to gain trust, which is exactly what happens when an attacker impersonates internal IT support. The attack is voice-based, but the core deception is the invented pretext, not the medium itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pretexting
Why this is correct
Pretexting is a social engineering attack where the attacker invents a false scenario or identity—here, a fabricated help desk technician—to establish trust and manipulate the victim into revealing credentials or other sensitive data. Unlike vishing, which often relies on automated recordings, this is a live, interactive conversation where the attacker actively builds a believable cover story and exploits the victim's inclination to comply with an authority figure. The success of pretexting hinges on the credibility of the invented pretext and the attacker's ability to sustain it through dialogue.
- ✗
Phishing
Why it's wrong here
Phishing is a broad social engineering category that typically uses fraudulent emails, text messages, or counterfeit websites to deceive victims into entering login credentials, clicking malicious links, or downloading malware. The attack vector is asynchronous and non-verbal; it does not involve a real-time phone conversation. While an attacker might later use a phone call to follow up on a phishing email, the core phishing technique relies on spoofed digital messages and fake web forms, not a fabricated identity presented over a live call.
- ✗
Vishing
Why it's wrong here
Vishing (voice phishing) is a form of phishing conducted over the phone, but it usually involves automated robocalls, pre-recorded messages, or a voice-over-IP service that spoofs a legitimate number to prompt the victim to enter a PIN, account number, or other sensitive data via touch-tone or connecting to a fraudulent agent. This scenario describes a direct, live impersonation of a help desk employee with a crafted backstory, which is the defining characteristic of pretexting rather than a scripted vishing call. Vishing often relies on call volume and generic urgency, whereas pretexting depends on the attacker's improvisational ability to sustain a believable, one-on-one social interaction.
- ✗
Shoulder surfing
Why it's wrong here
Shoulder surfing is a physical observation attack in which the attacker covertly watches the victim enter credentials, PINs, or access codes by looking over their shoulder, using binoculars, or capturing the input with a hidden camera. This method requires close physical proximity and direct visual access to the victim's device or keyboard, not an auditory phone interaction. Since the scenario is a phone call where the attacker speaks to the victim, shoulder surfing is categorically inapplicable here.
Go deeper
Related to this question
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.