220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Phishing

  Why it's wrong here

  Phishing is a broad social engineering technique that typically involves deceptive emails with malicious links or attachments to steal credentials or install malware. In this scenario, the attack is initiated by a live voice phone call, not by an electronic written message. Therefore, while the call could theoretically be an attempt at phishing, the more precise term for the voice-based vector is vishing, so phishing is not the best answer.

• ✓

  Vishing

  Why this is correct

  Vishing, or voice phishing, is the correct classification because the attacker uses a telephone call to impersonate a trusted entity and manipulate the user into revealing private information such as passwords, credit card numbers, or remote access. The attacker may spoof the caller ID to appear legitimate, but the defining characteristic is that the social engineering occurs over live or recorded voice communication. This directly matches the scenario where the user receives a phone call from an individual.

• ✗

  Smishing

  Why it's wrong here

  Smishing is a form of phishing delivered via SMS or text messaging, where the victim receives a text containing a malicious link or a prompt to call a number. In this case, the user's initial contact is an unsolicited incoming phone call, not a text message. Smishing requires the recipient to read and interact with a written message, so it cannot be the correct label for an attack that begins with a voice call.

• ✗

  Pretexting

  Why it's wrong here

  Pretexting is a social engineering technique where the attacker fabricates a believable scenario or identity—such as a bank investigator or IT support technician—to earn the victim's trust and extract information. While vishing attacks often use a pretext, pretexting itself does not specify the communication channel; it could occur in person, by email, or over the phone. Because the question asks specifically for the threat type given that the attack starts with a phone call, vishing is the more concrete and accurate answer, making pretexting secondary rather than the correct option.

Go deeper

Related to this question