Which Social Engineering Techniques Are Used in a Payroll Text Message?

SY0-701 By islever Editorial Last updated

Explain common threat vectors and attack surfaces.

Short answer

CE The text message is a smishing lure, and the sender is impersonating the payroll department to harvest employee credentials.

Question

An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)
  1. Typosquatting
  2. Phishing
  3. Impersonation Correct Answer
  4. Vishing
  5. Smishing Correct Answer

Key Takeaways

The exam tests whether you can separate the delivery channel (SMS = smishing) from the deception layer (pretending to be payroll = impersonation), while the trap is picking generic 'phishing' or the voice-based 'vishing'.

An employee receives an SMS that claims to come from the payroll department and asks for credential verification. The page establishes that this scenario combines two social engineering techniques — smishing (the SMS delivery vector) and impersonation (posing as payroll) — so the correct options are C and E.

Common mistake: Many candidates select phishing (B) as the second answer because smishing is technically a phishing subtype; however, CompTIA treats phishing as the traditional email vector, so choosing B alongside E leaves the obvious impersonation of the payroll department unaccounted for.

Expert Analysis

Why the Answer Is Correct

The message arrives as a text message, which is the defining delivery channel for smishing (SMS + phishing), and the sender is masquerading as the payroll department to make the credential request look legitimate. CompTIA's social engineering taxonomy lists impersonation separately from phishing variants: impersonation is the act of pretending to be a trusted person, department, or brand, which is exactly what "appears to have been sent by the payroll department" describes. Because the question asks which techniques are being attempted and requires two answers, the scenario intentionally pairs the vector (E) with the pretext (C). The credential-verification ask is the objective of both techniques working together — the text is the lure, the payroll identity is the trust hook. Nothing in the stem mentions a phone call, a spoofed domain, or a look-alike URL, so the vector-specific and pretext-specific answers are the only two that fit the wording.

Why the Other Options Are Wrong

Typosquatting (A) requires a misspelled or look-alike domain or URL, and the stem never describes a link, website, or domain — it only describes a text message and a credential request. Phishing (B) is superficially appealing because smishing is a phishing subtype, but the exam uses phishing as the email-based technique, so selecting B would leave two overlapping delivery-method answers and ignore the payroll impersonation entirely. Vishing (D) is voice phishing over a phone call; the scenario explicitly states a text message, not a call, so voice is the wrong channel. Community commenters captured this cleanly — FennecLola summarized the distinction as "Vishing = voice Phishing = email Smishing = text", and MAKOhunter33333333 reduced the stem to "Text messages = smishing Appears to be payroll = impersonation".

Community Comment Notes

The anonymous vote record is nearly unanimous for CE, with Etc_Shadow28000 explaining that the attacker pretends to be a trusted entity while using SMS. A minority, including oldbutgold, argued for BE and quoted CompTIA's guide that "Smishing: A phishing attack that uses SMS text communications as the vector.", contending that impersonation implies direct engagement rather than a mass text. IT_dude_in_training made the same case, saying the method of delivery is more precise than the act of pretending to be someone else. hasquaati acknowledged the overlap but concluded that smishing is "the most specific and direct answer", which is the reasoning this page endorses: when two answers are required, the exam rewards the specific vector plus the specific pretext, not a broad umbrella term.

Official Reference

https://www.comptia.org/certifications/security

This link opens the official vendor documentation in a new tab.

Exam Strategy

For 'Choose two' social engineering questions, first classify the channel named in the stem (email, SMS, voice, web), then classify the deception named in the stem (impersonation, pretexting, brand spoofing) — one tactic per answer slot. Resist the umbrella term (phishing) whenever a more specific sibling option (smishing, vishing) matches the channel described.

Frequently Asked Questions

Why isn't phishing (B) the second answer instead of impersonation (C)?

Smishing is already a phishing subtype, so pairing B with E would give two overlapping delivery answers and ignore the payroll masquerade. CompTIA reserves phishing for the traditional email vector; the identity deception here is impersonation.

How do I tell smishing apart from vishing in this scenario?

Vishing is voice phishing conducted over a phone call, while smishing uses SMS or text messaging. The stem specifies a text message, so the channel is smishing (E), and vishing (D) is the wrong vector.

More SY0-701 FAQ →

Community Votes

CE
100%

100% of anonymous learners picked answer CE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 21 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 21

  1. Etc_Shadow28000 👍 15
    In this scenario, where an employee receives a text message appearing to be from the payroll department asking for credential verification, the following social engineering techniques are being attempted: C. Impersonation - The attacker is pretending to be a trusted entity (the payroll department) to gain the employee's trust and obtain their credentials. E. Smishing - Smishing (SMS phishing) involves sending fraudulent text messages to trick individuals into revealing personal information, such as credentials, by clicking on a link or responding to the message.
  2. FennecLola 👍 8
    Vishing = voice Phishing = email Smishing = text
  3. pedrwc7 👍 6
    A. Typosquatting (Impersonation of legitimate URL) B. Phishing (Emails) C. Impersonation (Acting as someone) D. Vishing (Voice Phishing) E. Smishing (Message Phishing or Text Phishing) F. Misinformation (Providing wrong information or fake information or news)
  4. MAKOhunter33333333 👍 4
    Text messages = smishing Appears to be payroll = impersonation
  5. oldbutgold 👍 3
    CompTIA's official guide states: "Smishing: A phishing attack that uses SMS text communications as the vector." and "Phishing: "Persuades or tricks the target into interacting with a malicious resource disguised as a trusted one, traditionally using email as the vector." It is not impersonation because the Comptia Official guide specifically associates impersonation with direct engagement and persuasion techniques rather than mass communication tactics like smishing or phishing
Show 16 more comments
  1. hasquaati 👍 3
    This one is tricky, because Smishing is a part of Phishing. Its one of those annoying questions that Vendors like to throw at exam takers. Smishing is the most specific and direct answer to this question. Answer is CE.
  2. The_Body 👍 3
    Phishing = email Vishing = voice / phone call Smishing = SMS / Tex messages
  3. Markeze 👍 2
    The attacker is likely using a combination of C. Impersonation and E. Smishing to trick the employee into revealing their credentials.
  4. c80f5c5 👍 2
    phishing by classic definition is over email. Its a similar idea but going strictly by textbook definition it doesn't apply
  5. dbrowndiver 👍 1
    Answer C: Pretending to Be Payroll: The text message claims to be from the payroll department, a trusted entity within the company. This impersonation aims to create a sense of urgency and legitimacy, convincing the employee to comply with the request for credential verification. The attacker is leveraging the employee's trust in the payroll department to obtain sensitive information, which is a classic example of impersonation in social engineering. Answer E: The attack occurs through a text message, making it a clear case of smishing. The attacker uses SMS to deliver the deceptive message, which asks for credential verification under the guise of being from a legitimate source. Why it is important, since the message is delivered via text and is attempting to harvest credentials, it aligns perfectly with the definition of smishing.
  6. IT_dude_in_training 👍 1
    Although impersonation is indeed a tactic used in the attack (the attacker is impersonating the payroll department), the key focus of the attack is the method used (a fraudulent text message aimed at credential theft) rather than simply the act of pretending to be someone else. That is why the answers phishing (B) and smishing (E) are more precise for this scenario.
  7. Cyborg1407 👍 1
    Impersonation is a technique Smishing is a technique while Phishing which is also close is a Form. Impersonation and Smishing are under the category of Phishing
  8. JackExam2025 👍 1
    Given that the employee only receives a text message (not a phone call), the correct answers would be: E. Smishing C. Impersonation
  9. emputu22 👍 1
    the answer is C.Impersonation and E.Smishing
  10. kimitsuki 👍 1
    C.Impersonation and E.Smishing
  11. shady23 👍 3
    B. PhishingE. Smishing
  12. Yoez 👍 3
    Correct Answer: CE
  13. Hasss 👍 1
    impersonation and smishing
  14. f26ddcd 👍 1
    Smishing & Impersonate
  15. siddartha3390 👍 1
    i think it is: BD
  16. Jimmy1017 👍 1
    CE is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide