Whaling and Targeted Attacks in Social Engineering

312-50v12 By islever Editorial Last updated

Social Engineering

Short answer

A The attacker used Whaling by impersonating a high-ranking official to execute targeted attacks and access proprietary details.

Question

An experienced cyber attacker has created a fake LinkedIn profile, successfully impersonating a high-ranking official from a well-established company, to execute a social engineering attack. The attacker then connected with other employees within the organization, receiving invitations to exclusive corporate events and gaining access to proprietary project details shared within the network. What advanced social engineering technique has the attacker primarily used to exploit the system and what is the most likely immediate threat to the organization?
  1. Whaling and Targeted Attacks Correct Answer
  2. Pretexting and Network Vulnerability
  3. Spear Phishing and Spam
  4. Baiting and Involuntary Data Leakage

Key Takeaways

The scenario tests the distinction between broad phishing/whaling targets and pretexting methods, with the trap being the misidentification of 'impersonating an executive' as pretexting rather than whaling.

This question examines the use of whaling, a form of targeted social engineering where attackers impersonate high-ranking officials. It establishes that such impersonation on professional networks leads to targeted attacks compromising proprietary data.

Common mistake: Many learners select B (Pretexting) because they focus on the act of impersonation itself, overlooking that 'Whaling' is the specific term for targeting or impersonating C-level executives to gain high-value access.

Expert Analysis

Why the Answer Is Correct

The attacker impersonated a 'high-ranking official' to gain credibility and access to exclusive corporate events and proprietary details. This specific tactic of targeting or mimicking top-tier executives (C-suite) is known as Whaling, which is a subset of targeted attacks. The immediate threat is the compromise of sensitive intellectual property through these targeted interactions.

Why the Other Options Are Wrong

Option B (Pretexting) involves creating a fabricated scenario to engage a victim, but while impersonation is a form of pretexting, the specific context of 'high-ranking official' points directly to Whaling in CEH terminology. Option C (Spear Phishing) typically involves email-based attacks, whereas this scenario relies on LinkedIn networking. Option D (Baiting) involves offering something enticing, like a USB drive, which does not fit this profile.

Community Comment Notes

Several users pointed out that the key phrase 'high-ranking official' signals Whaling. One user noted, 'Impersonation of a high-ranking official... typical tactic in whaling attacks.' Another highlighted that the attacker gained 'access to proprietary project details,' confirming the targeted nature of the attack.

Exam Strategy

Always look for keywords indicating the target's seniority. When 'CEO', 'CFO', or 'high-ranking official' appears, consider Whaling over general Phishing or Pretexting, especially if the goal is high-value information access.

Frequently Asked Questions

Is impersonating an executive always Whaling?

In CEH contexts, yes. Whaling specifically refers to targeting or impersonating C-level executives to extract high-value information.

Why isn't this Spear Phishing?

Spear Phishing usually implies direct communication like email. Here, the attacker built a relationship via LinkedIn connections, fitting the broader 'Targeted Attack' model of Whaling.

More 312-50v12 FAQ →

Community Votes

A
58%
B
42%

58% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. przemyslaw1 👍 5 Answered B
    Pretexting: Fraudsters may impersonate executives from financial institutions, telephone companies, and other businesses. They rely on “smooth-talking” and win the trust of an individual to reveal sensitive information. CEH Module 09 - Social Engineering
  2. insaniunt 👍 4 Answered A
    A. Whaling and Targeted Attacks Whaling = An attacker targets high profile executives like CEOs, CFOs, politicians, and celebrities who have complete access to confidential and highly valuable information.The attacker tricks the victim into revealing critical corporate and personal information through email or website spoofing
  3. brrbrr 👍 3 Answered A
    Key words is "high-ranking official". then the most likely immediate threat to the organization is targeted attacks.
  4. rawal_ 👍 2 Answered A
    Why Option A (Whaling and Targeted Attacks) is Correct: Impersonation of a high-ranking official: The attacker posed as a senior executive on LinkedIn, which is a typical tactic in whaling attacks where high-profile individuals are impersonated to gain credibility and manipulate targets. Access to proprietary project details: By connecting with employees and gaining access to exclusive corporate events, the attacker successfully obtained sensitive information, demonstrating a targeted attack focused on acquiring valuable corporate data. Therefore, option A (Whaling and Targeted Attacks) best describes the advanced social engineering technique used by the attacker and identifies the most likely immediate threat to the organization
  5. Spam_Protection 👍 2 Answered B
    Pretexting Fraudsters may impersonate executives from financial institutions, telephone companies, and other businesses. They rely on “smooth-talking” and win the trust of an individual to reveal sensitive information.
Show 11 more comments
  1. qtygbapjpesdayazko 👍 2 Answered B
    Keyword "impersonating a high-ranking official" (Pretexting) not targeting CEOs (Whaling). From the book "Pretexting Fraudsters may impersonate executives from financial institutions"
  2. kennels 👍 2 Answered B
    I think this comment is right. > Pretexting: Fraudsters may~(przemyslaw1)
  3. qtygbapjpesdayazko 👍 2 Answered A
    A - Whaling - Key word "high-ranking official"
  4. LordXander 👍 1 Answered A
    So, in this context, A & B are strong contenders. A - seems more precies B - has that pretexting definition by the book However, Pretexting is part of Whaling and in the question be have nothing about Network Vulnerability but be have about a targeted Attack. So the final answer, and correct one, is A
  5. ametah 👍 1 Answered A
    Pretexting Fraudsters may impersonate executives from financial institutions, telephone companies, and other businesses. They rely on “smooth-talking” and win the trust of an individual to reveal sensitive information. CEHv12 Module 09 Page 1386
  6. blehbleh 👍 1 Answered A
    This is A, it is asking which advanced social engineering technique the attacker used. He didn't use baiting, spear phishing, or network vulnerabilities. He used whaling and targeted attacks. Literally, read the last part of the question.
  7. d02c2d5 👍 1 Answered D
    For me id D the fake linkedin profile lure other to invite the haker. Furthermore the haker has critical data that could point to Data Leakage
  8. JustAName 👍 1 Answered C
    I would choose C, should not be A because the person impersonate high-ranking official, not targeting high-ranking official.
  9. F4ll3n92 👍 1 Answered A
    in the scenario described, aren't things referred of a network vulnerability, so, i think that the correct answer is A
  10. multivolt 👍 1
    Im unsure about the accuracy of this statement
  11. dobarb 👍 1
    B. CEH 1386 key word is impresonate

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide