Identifying Impersonation vs Whaling in Social Engineering
An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The test assesses the ability to differentiate between the method (impersonating) and the target class (whaling), with the common trap being the selection of whaling simply because a CEO is mentioned.
This question distinguishes between impersonating a high-profile executive and the specific attack vector of whaling based on the target's identity. It establishes that impersonation is the technique used when an attacker pretends to be another person, regardless of their rank.
Many learners select 'Whaling' (D) because they associate the term exclusively with CEOs and executives, overlooking that whaling specifically refers to attacks *targeting* high-profile individuals, whereas this scenario involves an employee being tricked by an imposter.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The attacker is using Impersonating (C). Impersonation is a social engineering technique where an attacker assumes the identity of another person or entity to gain trust and manipulate victims. In this scenario, the attacker poses as the CEO to deceive an employee into purchasing gift cards. The core action is assuming a false identity.Why the Other Options Are Wrong
Whaling (D) is a specific type of phishing that targets high-profile individuals like CEOs or CFOs. Here, the victim is a regular employee, not the executive; the executive is merely the persona being adopted. Therefore, whaling does not describe the attack against the employee. Smishing (A) involves SMS messages, which are not mentioned. Disinformation (B) refers to spreading false information broadly, not a targeted deceptive interaction based on assumed identity.Community Comment Notes
The community was divided, with many voters choosing C but some arguing for D. As BugG5 noted, "Impersonating involves pretending to be someone else... to deceive the employee." While Migzz argued for whaling because it involves a CEO, the exam logic prioritizes the mechanism (impersonation) over the persona's title when the target is not the executive themselves. Several users like Glacier88 correctly identified that since the target is an employee, impersonation is the most accurate technical description of the tactic used against them.Exam Strategy
Always analyze who the direct victim is in a social engineering scenario. If the victim is an executive, think Phishing/Whaling. If the victim is anyone else but the attacker claims to be an executive, think Impersonation/BEC.
Frequently Asked Questions
Why is this not Whaling if the CEO is involved?
Whaling targets high-profile individuals. Since the victim here is an employee, not the executive, it is impersonation, not whaling.
What is the difference between Impersonating and Disinformation?
Impersonating involves actively pretending to be a specific person to manipulate a victim. Disinformation is the general spread of false information without necessarily assuming a specific identity.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →