Spear Phishing vs General Phishing in Targeted Emails
Short answer
A Investigate spear phishing because the email is specifically targeted to the accounting department using relevant regulatory context.
Question
Which type of cybersecurity threat should you investigate?
Key Takeaways
The key distinction is the specific targeting of a group (accounting department) with relevant context, which defines spear phishing rather than generic phishing or other vectors like smishing or vishing.
This question tests the ability to distinguish spear phishing from other social engineering threats based on target specificity and delivery method. It establishes that targeted emails using relevant topics are classified as spear phishing.
Common mistake: Learners often confuse spear phishing with general phishing, failing to recognize that the specific targeting and contextual relevance elevate it to spear phishing.
Expert Analysis
Why the Answer Is Correct
The correct answer is A (Spear Phishing). Spear phishing is a targeted form of phishing where the attacker specifically targets an individual or organization, often using personalized information to make the attack more convincing. In this scenario, the email is directed specifically at the accounting department and references federal accounting regulations, which is highly relevant to their role. This level of personalization and targeting distinguishes it from general phishing campaigns.
Why the Other Options Are Wrong
B (Ransomware) is incorrect because ransomware is malware that encrypts files for ransom, not a social engineering attack vector via email hyperlinks alone. C (Smishing) is incorrect because smishing refers to phishing attempts conducted via SMS/text messages, not email. D (Vishing) is incorrect because vishing involves voice calls, whereas this threat is delivered through an email hyperlink.
Community Comment Notes
As Roattana noted, the targeting is specific to the accounting department, which is a hallmark of spear phishing. The comment correctly identifies that the use of a relevant topic (federal accounting regulations) makes the attack more convincing and targeted, fitting the definition of spear phishing perfectly.
Exam Strategy
Always look for keywords indicating specificity or targeting (e.g., 'department', 'executive', 'specific project') when distinguishing spear phishing from general phishing. Remember that the delivery method (email) rules out smishing and vishing immediately.
Frequently Asked Questions
Why is this not general phishing?
Can a hyperlink be part of smishing?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Roattana 👍 1 Answered ATargeted Audience: The email is highly targeted specifically to employees in the accounting department, using a relevant topic (federal accounting regulations) to trick them. This specific targeting distinguishes it from general phishing. Delivery Method: It is sent via email containing a malicious hyperlink, which is the classic vector for spear phishing.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.