Which of the following scenarios best illustrates a spear phishing attack?
A.
Numerous and consistent attacks on the company's website caused the server to crash and service was disrupted.
B.
A person posing as a representative of the company’s IT help desk called several employees and played a generic prerecorded message requesting password data.
C.
A person received a personalized email regarding a golf membership renewal, and he click a hyperlink to enter his credit card data into a fake website
D.
Many users of a social network service received fake notifications of e unique opportunity to invest in a new product.
Spear phishing is a targeted cyberattack where attackers send personalized emails to trick individuals into providing sensitive data (e.g., passwords, financial information).
Unlike regular phishing, which casts a wide net, spear phishing is highly customized and often appears to come from a trusted source.
Why Option C Is Correct?
The scenario describes a highly personalized email (related to a golf membership) that tricks the recipient into clicking a malicious hyperlink and entering sensitive data.
This matches the definition of a spear phishing attack, where an attacker tailors a scam specifically for an individual.
IIA GTAG 16 – Data Analytics and ISO 27001 emphasize the need for security awareness training to mitigate such threats.
Why Other Options Are Incorrect?
Option A (Website attack causing a server crash):
This describes a Denial-of-Service (DoS) attack, not spear phishing.
Option B (Generic recorded message requesting password data):
This is vishing (voice phishing), not spear phishing. Spear phishing relies on personalized emails.
Option D (Fake social media investment opportunity):
This describes mass phishing, which targets multiple users, unlike spear phishing, which is highly targeted.
Spear phishing is a targeted attack that uses personal details to deceive individuals, making option C the best choice.
IIA GTAG 16 and ISO 27001 emphasize cybersecurity awareness to prevent such attacks.
Final Justification:IIA References:
IIA GTAG 16 – Data Analytics in Cybersecurity Audits
ISO 27001 – Cybersecurity Best Practices
NIST SP 800-61 – Incident Response Guidelines for Phishing Attacks
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit