Was the CFO Impersonation Call Social Engineering or Whaling?
Explain common threat vectors and attack surfaces.
Given a scenario, implement security awareness practices.
After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?
Answer
Correct answer: C — The caller used social engineering by impersonating the CFO and pressing for credit card information, the manipulation topic the user recognized from awareness training.
Community Votes
84% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can separate the broad social engineering umbrella from its whaling subset — the trap is picking 'executive whaling' merely because a CFO is named, even though the CFO was impersonated, not targeted.
A help-desk user recognized a pretext call pressing for credit card information 'on behalf of the CFO' as social engineering rather than executive whaling. This page explains why impersonating an executive by phone is the classic social engineering pattern tested on SY0-701.
Choosing D, executive whaling, because the caller invoked the CFO's title. Whaling targets a senior executive directly, typically through a crafted email; here the actual victim was an ordinary employee contacted by phone.
Community Discussion (22 comments)
EXAMM3R
👍 20
Executive whaling is when the CFO is one being targeted, therefore the answer is C
geocis
👍 9
Answer is C....Social engineering is the practice of manipulating people into performing actions or divulging confidential information, often by impersonating someone else or creating a sense of urgency or trust. The suspicious caller in this scenario was trying to use social engineering to trick the user into giving away credit card information by pretending to be the CFO and asking for a payment. The user recognized this as a potential scam and reported it to the IT help desk. The other topics are not relevant to this situation.
edward0811
👍 1
Selected: C
The answer is C - We have to read the question carefully. At the end of the question, it says, "Which of the following TOPICS". The only one that truly qualifies as a "TOPIC" is social engineering. All the others are examples of social engineering.
TECHBOSS
👍 1
Selected: C
C: SOCIAL ENGINEERING. The two parties are the IT individual and the CALLER threatening AS IF they were the CFO. Whaling involves ACTULLY targeting the CFO. "IT" is the target.
917a0a9
👍 3
Selected: C
"executive whaling" is a term used in cybersecurity, referring to a highly targeted phishing attack specifically aimed at high-level executives like CEOs, CFOs, or other senior leaders within an organization, essentially meaning the "whale" in this analogy is the high-value target, the executive with significant access to sensitive information Answer is social engineering. The CFO WAS NOT the target in this scenario
courtr
👍 1
Selected: C
voice phishing is a type of social engineering. executive whaling would only be the case if the CFO was the target receiving the call.
myazureexams
👍 1
Selected: C
C- SOCIAL engineering The user recognized the topic of social engineering from the security awareness training session. Executive whaling, also known as "whaling," is a specific type of social engineering attack where the attacker impersonates a high-ranking executive. In this scenario, the user identified a social engineering attempt, even if they didn't specify executive whaling.
PAWarriors
👍 1
Selected: C
Correct answer is C. The scenario described is social engineering. As mentioned by other members, "executive whaling" is a form of spear phishing that targets high-profile individuals, like CEOs or CFOs. In this case a regular "user" is the one that received the call a not a high-profile individual.
Cyber_Texas
👍 1
Selected: C
It is C because someone is pretending to be someone else that would classify as social engineering
Crucible_Bro
👍 1
Selected: C
someone is pretending to be someone within the company with authority. Social engineering.
dbrowndiver
👍 5
Selected: C
Suspicious caller impersonated someone with authority (CFO) to trick the user into providing credit card information. This is a classic example of social engineering, where the attacker exploits trust and urgency to extract sensitive data. The scenario matches the characteristics of a social engineering attack, as it involves manipulating the victim through a phone call rather than using technological methods or digital communication channels.
Dlove
👍 5
Selected: C
C. Social Engineering We have to pay attention to the question because they can be very tricky. They didn't specifically target the CFO they simply mentioned the person and said they wanted credit card info. Based on the question that we have the correct answer is C
Bimbo_12
👍 4
Selected: C
C. Social engineering Explanation: Social engineering is a manipulation technique that exploits human error to gain private information, access, or valuables. In this scenario, the suspicious caller was attempting to deceive the user into providing credit card information by falsely claiming to be acting on behalf of the Chief Financial Officer. This tactic is a classic example of social engineering, where the attacker uses social manipulation rather than technical hacking methods to obtain sensitive information. It is not D because this is a type of phishing attack that specifically targets high-profile executives (also known as "whales") to steal sensitive information. While the scenario does involve the mention of a high-ranking executive, it is broader in scope and fits under the general category of social engineering rather than a specific whaling attack through email.
TheMichael
👍 3
Selected: C
How I understand it is Whaling is when they impersonate an executive, executive whaling is when they target an executive (spearfishing in a sense), and social engineering is a broad form of trickery to deceive whoever the target is (not specific) to divulge information.
78fcd3e
👍 2
Selected: C
In CompTIA's lessons for 701, the only reference I could find for "whaling" is a definition of "targeting employees that have influential roles." I'm going with C. Social engineering
mnphobby
👍 3
C Whaling is send email to the Ceo
b3a128a
👍 3
It has to be C because the caller is stating the CFO wants the information, he is not saying he is the CFO.. also the term is whaling, not executive whaling
101e7ca
👍 3
Selected: C
For the 601 exam Whaling referred to the CEO being hit by a phishing attack...ie email. It targets a high value individual through email. This scenario says that someone called in to impersonate the CFO (high level individual) which is social engineering. There seems to be a term called Executive Phishing but not Executive Whaling. This could be a CompTIA question where they mix the terms to catch you out. Doesn't help that in the real world we often use these terms interchangeably.
AbdullahMohammad251
👍 5
Selected: D
Social engineering encompasses a wide variety of techniques and psychological tactics to exploit human vulnerabilities. - Whaling: This is a type of social engineering attack that targets high-profile individuals by impersonating them to deceive other employees into divulging sensitive information or performing actions that compromise security. -The scenario described clearly involved the impersonation of a CFO, which makes option D the correct answer.
johnysmith
👍 1
Selected: D
Executive Whaling
cdsu
👍 4
C: Social enginerring This involves impersonation of an executive, it is done via a phone call rather than an email
Shaman73
👍 3
D. Executive whaling
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Social engineering is the manipulation of people — through impersonation, authority and urgency — into divulging confidential information, and this call contains every element of that definition. The caller falsely claimed to act for the Chief Financial Officer and manufactured time pressure (closing an invoice) to extract credit card data from an ordinary employee, which is exactly the vishing-style pretext the awareness session covered. Because social engineering is the umbrella category, recognizing the manipulation itself is the correct, broad answer for what the user learned. CompTIA consistently classifies pretexting, impersonation and phone-based deception under social engineering techniques rather than as separate high-level topics. The user's decision to call the help desk instead of complying shows the training objective was met at the concept level.Why the Other Options Are Wrong
A, insider threat, is wrong because no internal employee misused legitimate access — the malicious actor was external and only borrowed an executive's identity as a pretext. B, email phishing, is wrong on channel: the contact was a suspicious phone call, and no email, link or attachment is described, so the training topic recognized could not have been email phishing. D, executive whaling, is the strongest distractor but misfires: whaling targets a 'big fish' executive directly, usually through a highly tailored email to the CFO or CEO. In this scenario the CFO was never the victim; the CFO's name was the bait, which points back to generic social engineering. As commenter 917a0a9 put it, "the CFO WAS NOT the target" — the person answering the phone was.Community Comment Notes
EXAMM3R framed the distinction cleanly: "Executive whaling is when the CFO is one being targeted, therefore the answer is C," and dbrowndiver added that the caller "impersonated someone with authority (CFO)" to exploit trust and urgency. Dloves stressed reading the wording carefully because the question never says the CFO was targeted, only mentioned, while TheMichael drew the same line between impersonating an executive and targeting one. AbdullahMohammad251 voted D by arguing whaling is a subtype of social engineering that uses impersonation, which is true as far as it goes but inverts the victim — the whaling victim must be the executive. cdsu's note that the contact came "via a phone call rather than an email" reinforces that phishing-specific options do not fit.Official Reference
Exam Strategy
When a stem names an executive, first ask who the victim actually is: if the executive is the one being deceived or compromised, think whaling; if the executive's name is only a pretext used against a regular employee, choose the broader social engineering answer. Matching the described channel (phone call, email, text) against the option wording eliminates channel-specific distractors quickly.
Frequently Asked Questions
Why is executive whaling wrong when the caller mentions the CFO?
Whaling targets the executive themselves, usually via a tailored email. Here the CFO's name was only a pretext used against a regular employee, so the broader social engineering label fits.
Is a deceptive phone call like this phishing or vishing?
It is vishing, a voice-based social engineering attack. Since vishing is not offered as an option, the correct umbrella choice is social engineering (C), not email phishing (B).
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →