SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A help desk agent receives a phone call from someone claiming to be a regional sales manager who says they are locked out before a customer demo. The caller knows a few employee names and asks the agent to reset the account and temporarily bypass MFA. What attack is most likely?
⚠ Common exam trap
Watch out — candidates often confuse pretexting (the false identity) with the delivery method (vishing), but the exam expects you to identify the specific attack vector—voice call—as the defining characteristic of vishing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vishing, because the attacker is using a voice call to pressure support staff into changing access.
Vishing (voice phishing) specifically involves using a phone call to socially engineer a target into performing an action, such as resetting credentials and bypassing MFA. The attacker pressures the help desk agent by creating urgency around a customer demo, which is a classic vishing tactic to bypass security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spear phishing, because the caller used specific employee details to appear credible.
Why it's wrong here
Spear phishing is a form of phishing that uses personalized details to make a malicious email or message appear legitimate, typically delivered through electronic channels such as email or direct messaging. In this scenario, the contact is made via a live phone call, not through an email or message, so the attack vector does not align with spear phishing. While the caller's knowledge of employee details increases credibility, that alone does not classify the attack as spear phishing; the voice channel makes vishing the correct classification.
- ✓
Vishing, because the attacker is using a voice call to pressure support staff into changing access.
Why this is correct
Vishing, or voice phishing, is a social engineering technique that exploits the telephone to trick victims into divulging sensitive information or performing actions that compromise security. The attacker here uses a voice call to impersonate an employee, creates urgency to pressure the help desk agent, and requests that access credentials be changed and MFA controls be weakened. Because the entire attack hinges on a live voice interaction, vishing is the most precise label for this scenario, distinguishing it from email-based phishing or in-person social engineering.
- ✗
Pretexting, because the attacker is creating a false identity and believable story.
Why it's wrong here
Pretexting is the fabrication of a scenario or false identity to manipulate a target into providing information or access, and it is indeed part of the attacker's approach. However, pretexting describes the narrative layer of the deception, not the delivery method; it can be used in emails, calls, or in-person interactions. Since the attack here is specifically conducted over a phone call, the more accurate classification is vishing, which encompasses both the voice vector and the pretextual story, making vishing the better answer.
- ✗
Baiting, because the attacker offered a tempting opportunity tied to a customer demo.
Why it's wrong here
Baiting is a social engineering tactic that offers a physical or digital lure, such as a free USB drive, an infected download, or another tempting item, to trick a victim into taking an action that installs malware or exposes credentials. In this scenario, the attacker does not offer any such bait; instead, they fabricate a customer demo as part of their false narrative to request changes. The absence of a tangible or digital lure means the attack does not fit baiting, and the live voice call reinforces vishing as the correct classification.
Go deeper
Related to this question
Learn chapter
Phishing, Vishing, and Smishing
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.