CEH Social Engineering and Physical Security Practice Question

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

⚠ Common exam trap

EC-Council often tests the distinction between spear phishing and whaling by emphasizing that whaling specifically targets senior executives, while spear phishing can target any individual or role within an organization.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Whaling

This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Pharming
Why it's wrong here
Pharming is a cyberattack that redirects users from legitimate websites to fraudulent ones without their knowledge, typically through DNS cache poisoning or modifying a host file on a victim's computer. Unlike the scenario described, pharming does not involve an email impersonating an executive directly but rather manipulates domain name resolution to trick victims into entering credentials on a fake site. The attack vector is infrastructure-based, altering where a domain name points, rather than relying on the content of an email.
✗
Spear phishing
Why it's wrong here
Spear phishing is a highly targeted form of phishing that customizes messages for specific individuals or organizations, often leveraging personal information to increase credibility and bypass generic email filters. While it involves targeting a specific person via email, its defining characteristic is not necessarily the impersonation of a high-level executive like a CEO, but rather the personalized nature of the attack. The focus is on exploiting known details about the target to build trust, rather than specifically leveraging the authority of a C-suite title.
✓
Whaling
Why this is correct
Whaling is a specialized form of spear phishing that specifically targets high-profile individuals, such as senior executives, CEOs, or government officials, or impersonates them to deceive employees. In this scenario, an email appearing to be from the CEO directly aligns with the definition of whaling, as it leverages the authority of a top executive to induce a specific action. The objective is often to trick recipients into making large financial transfers or divulging sensitive corporate data, exploiting the perceived urgency and command from a C-level executive.
✗
Vishing
Why it's wrong here
Vishing, or voice phishing, is a social engineering attack conducted over the telephone, often using Voice over IP (VoIP) to spoof caller IDs and impersonate legitimate entities. This method relies on verbal deception and psychological manipulation to trick victims into revealing personal information or performing actions, such as installing malware or transferring funds. Since the question explicitly states the employee received an email, vishing, which is strictly a voice-based attack, is not the correct classification for this particular scenario.

Go deeper

CEH Social Engineering and Physical Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question