220-1102 Practice Question: A user receives a phone call from someone…

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Phishing

  Phishing is usually performed via email or malicious websites, not a direct phone call.

• ✗

  Smishing

  Smishing uses SMS text messages, not a phone call.

• ✗

  Shoulder surfing

  Shoulder surfing involves looking over someone's shoulder to observe information, not a phone call request.

Technical deep dive

How to think about this question

Vishing, a portmanteau of 'voice' and 'phishing,' is a social engineering technique where attackers use telephone calls to trick individuals into divulging sensitive information or performing actions that compromise security. In this scenario, the attacker directly called the user, impersonating the IT help desk, which is a classic vishing tactic. The goal was to exploit the user's trust in the IT department to obtain their login password and a multi-factor authentication (MFA) code. This direct, real-time voice interaction is the defining characteristic that differentiates vishing from other forms of social engineering. The attacker's immediate request for both a password and an MFA code indicates an attempt to bypass multiple layers of security, often by creating a sense of urgency or fear, such as claiming a 'security breach.' The critical distinction here lies in the medium of communication. While phishing broadly refers to fraudulent attempts to obtain sensitive information by disguising as a trustworthy entity, it is typically associated with email-based attacks. Smishing, on the other hand, specifically utilizes SMS text messages for its malicious intent. Shoulder surfing is a physical attack, relying on direct observation rather than remote communication. The scenario explicitly states the user received a 'phone call,' which immediately narrows down the possibilities to vishing, as it is the only option that describes a voice-based social engineering attack. The attacker's ability to engage in a live conversation allows for dynamic manipulation and real-time responses to the victim's reactions, making it a particularly effective and dangerous form of social engineering.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…