220-1102 Practice Question: A user receives an email that appears to be from…

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Whaling

  Whaling targets executives or high-profile individuals, not the general employee base.

• ✗

  Spear phishing

  Spear phishing is a targeted attack aimed at a specific individual or organization, not a broad email to all employees.

• ✗

  Vishing

  Vishing (voice phishing) is performed over the phone, not via email.

Technical deep dive

How to think about this question

Phishing is a foundational social engineering technique where attackers attempt to trick individuals into revealing sensitive information, such as login credentials, or deploying malware, by masquerading as a trustworthy entity. In this scenario, the email purports to be from the company's payroll department, a seemingly legitimate and authoritative source, and requests users to click a link and log in with corporate credentials. The critical clue identifying this as phishing is the broad, untargeted nature of the attack (sent to 'all employees') combined with the fraudulent sender's email address ('payroll@cornpany.com'), which uses a subtle typo ('rn' instead of 'm') to deceive recipients. This 'typosquatting' or URL hijacking technique is a classic indicator of a phishing attempt, designed to bypass casual scrutiny. The goal is to harvest corporate credentials for potential unauthorized access or further attacks. This differs from spear phishing because spear phishing is highly targeted, often leveraging specific personal information about the recipient to increase its credibility, whereas this email was sent to a general employee base. Whaling is a form of spear phishing specifically aimed at high-value targets like executives, which is not the case here as it targets 'all employees.' Vishing, or voice phishing, is conducted over the phone, using social engineering tactics to elicit information, which is distinct from an email-based attack. The broad distribution and the deceptive sender address are the hallmarks that firmly place this attack within the definition of general phishing.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…