SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst notices that several employees have received an email with the subject line 'Urgent: Password Reset Required'. The email contains a link to a website that mimics the company's internal login portal. The email was sent from an external domain and addresses recipients by 'Dear Employee' rather than their actual names. Which type of social engineering attack is being described?
⚠ Common exam trap
Many exam-takers confuse 'phishing' with 'spear phishing' because both use email and fake login pages, but the key differentiator is the level of personalization—generic vs. targeted—which the 'Dear Employee' greeting explicitly reveals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Phishing
The email is sent to multiple employees, uses a generic greeting ('Dear Employee'), and originates from an external domain, which are hallmarks of a broad, untargeted phishing campaign. Spear phishing would involve personalized details (e.g., the recipient's actual name) and targeting specific individuals. Vishing is voice-based, not email. Therefore, this is a standard phishing attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spear phishing
Why it's wrong here
Spear phishing is a targeted form of phishing that uses personalized information (e.g., the recipient's name) to increase credibility. The email in the scenario uses a generic greeting, indicating it is not tailored to specific individuals.
When this WOULD be correct
Spear phishing would be correct if the email was personalized with the recipient's name, job title, or other specific details, and targeted a particular individual or department within the organization.
- ✓
Phishing
Why this is correct
Phishing is a broad social engineering technique that uses mass emails to trick users into divulging credentials or clicking malicious links. The generic greeting and external sender domain are consistent with a typical phishing attempt.
- ✗
Vishing
Why it's wrong here
Vishing, or voice phishing, is conducted over telephone systems, using VoIP spoofing and social engineering to impersonate legitimate callers or automated services. Because the observed incident involves emails with an external sender domain and generic greetings, the delivery vector is clearly electronic messaging, not voice. Even when vishing and phishing have similar malicious goals, the channel difference is the defining characteristic used to classify the attack.
- ✗
Tailgating
Why it's wrong here
Tailgating is a physical security threat where an unauthenticated individual follows an authorized employee through a door or controlled barrier, often exploiting courtesy or distraction. This scenario describes a digital email-based deception, not an attempt to gain physical access to a restricted facility. Although both rely on social engineering, tailgating requires proximity and fails when applied to a remote email campaign.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓PhishingCorrect answer▾
Why this is correct
Phishing is a broad social engineering technique that uses mass emails to trick users into divulging credentials or clicking malicious links. The generic greeting and external sender domain are consistent with a typical phishing attempt.
✗Spear phishingWrong answer — click to see why▾
Why this is wrong here
The email is not personalized (uses 'Dear Employee') and targets a broad audience, not a specific individual or group, which distinguishes it from spear phishing.
★ When this WOULD be the correct answer
Spear phishing would be correct if the email was personalized with the recipient's name, job title, or other specific details, and targeted a particular individual or department within the organization.
Why candidates choose this
Candidates may confuse spear phishing with phishing because both involve deceptive emails, but spear phishing requires targeted personalization, which is absent here.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Social Engineering Attacks
Key term
Vishing
Vishing is a social engineering attack where criminals use phone calls or voice messages to trick victims into revealing sensitive information.
Key term
Spear phishing
Spear phishing is a targeted cyberattack in which a criminal sends a fraudulent email that appears to come from a trusted source, aiming to trick a specific person or organization into revealing sensitive data or installing malware.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.