A user reports receiving an email that appears to be from a well-known shipping company. The email states that a package delivery could not be completed and asks the user to click a link to reschedule. The user clicks the link, which opens a webpage that looks like the shipping company's login page, and enters their email address and password. Which type of social engineering attack has occurred?

Vishing

Incorrect. Vishing (voice phishing) is performed over the phone, not through email.

Spear phishing

Incorrect. Spear phishing is a targeted form of phishing that uses personalized information to trick a specific individual. The scenario does not indicate any personalization.

Whaling

Incorrect. Whaling is a targeted attack on high-profile individuals such as executives. The user described is a regular employee.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Phishing — This is a phishing attack. Phishing is a social engineering technique where attackers send fraudulent emails that appear to come from a legitimate source, such as a shipping company, bank, or online service, to trick recipients into revealing sensitive information (like credentials) or clicking malicious links. In this scenario, the email and fake login page are designed to steal the user's credentials. Vishing (voice phishing) involves phone calls, not email. Spear phishing is a targeted version aimed at a specific individual or organization, often using personalized information, but the scenario describes a generic email sent broadly. Whaling is a type of spear phishing targeting high-profile individuals like executives. Since the attack used email and a fake login page, it is standard phishing.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.