SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Phishing

  Why it's wrong here

  Phishing involves sending deceptive emails or messages that trick users into clicking malicious links or providing sensitive information. In this scenario, users typed the correct URL and were redirected, so no click on a malicious link occurred.

  When this WOULD be correct

  Phishing would be correct if the question described employees receiving fraudulent emails with links to a fake login page, without any mention of DNS compromise.

• ✗

  Spear phishing

  Why it's wrong here

  Spear phishing is a highly targeted form of phishing that uses personalized, context-aware emails or messages to convince a specific individual or small group to click a malicious link or attachment. The scenario describes numerous employees being redirected after typing the correct URL, which suggests a shared technical vulnerability rather than individually crafted malicious correspondence. Furthermore, no deceptive message, bespoke lure, or user interaction with a link is described, so spear phishing's essential characteristics are absent.

  When this WOULD be correct

  A security analyst finds that employees received personalized emails with a link to a fraudulent login page that mimics the company application, and the emails were crafted using information from social media. This would be spear phishing.

• ✓

  Pharming

  Why this is correct

  Pharming is an attack that manipulates the domain resolution process, typically by poisoning a DNS server or altering a local hosts file. When an employee enters the correct URL, the system receives a malicious IP address and silently lands on a fraudulent website, so no click on a poisoned link is required. Because this scenario explicitly mentions a DNS server compromise that redirects users system-wide, pharming directly matches the mechanism and scope described.

• ✗

  Vishing

  Why it's wrong here

  Vishing, or voice phishing, is a social engineering attack conducted over phone calls or VoIP, where attackers spoof caller ID and use urgency to trick victims into divulging credentials or PII. This incident contains no mention of voice communications, call transcripts, or interpersonal deception; instead, the redirection is caused by an infrastructure-level DNS compromise. Even if vishing could theoretically be combined with other attacks, the presented evidence points strictly to a network-layer technique, not a telephony-based one.

  When this WOULD be correct

  A security analyst receives reports that employees are getting fraudulent calls asking them to disclose their login credentials for a company application. Which type of attack best describes this scenario?

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question