CEH Practice Question: Malware, Social Engineering and Network Attacks
An attacker sends an email that appears to come from the CEO of the company, requesting an urgent wire transfer to a specific account. This is an example of which social engineering attack?
⚠ Common exam trap
Watch out — candidates often confuse whaling with spear phishing because both are targeted, but whaling is specifically reserved for attacks against senior executives or high-value targets, not just any individual.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whaling
Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like the CEO or CFO. In this scenario, the attacker impersonates the CEO to trick an employee into authorizing a fraudulent wire transfer, which is the classic hallmark of whaling rather than generic phishing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Whaling
Why this is correct
Whaling is a highly specialized form of spear phishing that specifically targets high-profile individuals within an organization, such as CEOs, CFOs, or other senior executives. The attacker crafts extremely convincing emails, often spoofing the identity of a trusted internal or external party, to trick these 'big fish' into divulging sensitive information or authorizing fraudulent transactions. The objective is typically significant financial gain or access to critical corporate data, leveraging the executive's authority and perceived urgency.
- ✗
Spear phishing
Why it's wrong here
Spear phishing involves a targeted attack against a specific individual or a small group of individuals, distinct from broad, indiscriminate phishing campaigns. Attackers conduct reconnaissance to personalize emails with relevant details, increasing their credibility and the likelihood of the recipient falling victim. While more focused than general phishing, it does not exclusively target senior executives, making it a broader category than whaling in terms of target seniority and organizational impact.
- ✗
Phishing
Why it's wrong here
Phishing is a broad, non-specific social engineering attack that attempts to trick a large number of recipients into revealing sensitive information, such as login credentials or financial details, or installing malware. These attacks typically use generic lures, like fake bank alerts or password reset requests, sent en masse without significant personalization for individual targets. The scenario described, targeting a specific CEO with a spoofed email, is far more refined and targeted than a general phishing campaign.
- ✗
Pretexting
Why it's wrong here
Pretexting is a social engineering technique where an attacker creates a fabricated scenario or 'pretext' to manipulate a victim into divulging information or performing an action. This often involves extensive two-way communication, such as phone calls or prolonged email exchanges, where the attacker assumes a false identity and builds a believable story to gain trust. While it involves deception, the question's scenario primarily describes an email identity spoofing attack, which is characteristic of whaling, rather than an elaborate conversational pretext for information gathering.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.