220-1102 Practice Question: A user receives an email that appears to be from…

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Spear phishing

  Spear phishing is targeted at specific individuals; this appears to be a generic email.

• ✗

  Whaling

  Whaling targets senior executives; there is no indication the email is aimed at a top-level employee.

• ✗

  Vishing

  Vishing uses voice communication (phone calls), not email.

Technical deep dive

How to think about this question

The scenario presented describes a classic example of a phishing attack. Phishing is a widespread social engineering technique where attackers attempt to trick users into revealing sensitive information, such as usernames, passwords, or credit card details, by masquerading as a trustworthy entity. This is typically done through deceptive emails, text messages, or websites. In this case, the email pretends to be from the company's IT department, creating a sense of urgency and legitimacy by mentioning a 'security breach' and requesting 'account verification.' The critical indicator here is the email address 'it-support@company-update.com,' which is designed to look similar to a legitimate company domain but is subtly different, a common tactic to bypass initial scrutiny and exploit user trust. The key characteristic making this phishing, rather than spear phishing, is the apparent lack of specific targeting. While it's sent to a company user, the prompt doesn't suggest it's tailored to that individual's role, name, or specific company details beyond a generic 'IT department' request. Spear phishing would involve a more personalized approach, perhaps referencing the user's name, department, or a recent project, making it much harder to detect. Whaling is a specific type of spear phishing aimed at high-value targets like CEOs or CFOs, which is not indicated here. Vishing, on the other hand, exclusively uses voice communication, such as phone calls, to execute the social engineering attack, which clearly doesn't apply to an email-based scenario.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…