Which Social Engineering Techniques Are Used in a Payroll Text Message?
An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)
Community Votes
100% of anonymous learners picked answer CE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can separate the delivery channel (SMS = smishing) from the deception layer (pretending to be payroll = impersonation), while the trap is picking generic 'phishing' or the voice-based 'vishing'.
An employee receives an SMS that claims to come from the payroll department and asks for credential verification. The page establishes that this scenario combines two social engineering techniques — smishing (the SMS delivery vector) and impersonation (posing as payroll) — so the correct options are C and E.
Many candidates select phishing (B) as the second answer because smishing is technically a phishing subtype; however, CompTIA treats phishing as the traditional email vector, so choosing B alongside E leaves the obvious impersonation of the payroll department unaccounted for.
Community Discussion (21 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The message arrives as a text message, which is the defining delivery channel for smishing (SMS + phishing), and the sender is masquerading as the payroll department to make the credential request look legitimate. CompTIA's social engineering taxonomy lists impersonation separately from phishing variants: impersonation is the act of pretending to be a trusted person, department, or brand, which is exactly what "appears to have been sent by the payroll department" describes. Because the question asks which techniques are being attempted and requires two answers, the scenario intentionally pairs the vector (E) with the pretext (C). The credential-verification ask is the objective of both techniques working together — the text is the lure, the payroll identity is the trust hook. Nothing in the stem mentions a phone call, a spoofed domain, or a look-alike URL, so the vector-specific and pretext-specific answers are the only two that fit the wording.Why the Other Options Are Wrong
Typosquatting (A) requires a misspelled or look-alike domain or URL, and the stem never describes a link, website, or domain — it only describes a text message and a credential request. Phishing (B) is superficially appealing because smishing is a phishing subtype, but the exam uses phishing as the email-based technique, so selecting B would leave two overlapping delivery-method answers and ignore the payroll impersonation entirely. Vishing (D) is voice phishing over a phone call; the scenario explicitly states a text message, not a call, so voice is the wrong channel. Community commenters captured this cleanly — FennecLola summarized the distinction as "Vishing = voice Phishing = email Smishing = text", and MAKOhunter33333333 reduced the stem to "Text messages = smishing Appears to be payroll = impersonation".Community Comment Notes
The anonymous vote record is nearly unanimous for CE, with Etc_Shadow28000 explaining that the attacker pretends to be a trusted entity while using SMS. A minority, including oldbutgold, argued for BE and quoted CompTIA's guide that "Smishing: A phishing attack that uses SMS text communications as the vector.", contending that impersonation implies direct engagement rather than a mass text. IT_dude_in_training made the same case, saying the method of delivery is more precise than the act of pretending to be someone else. hasquaati acknowledged the overlap but concluded that smishing is "the most specific and direct answer", which is the reasoning this page endorses: when two answers are required, the exam rewards the specific vector plus the specific pretext, not a broad umbrella term.Official Reference
Exam Strategy
For 'Choose two' social engineering questions, first classify the channel named in the stem (email, SMS, voice, web), then classify the deception named in the stem (impersonation, pretexting, brand spoofing) — one tactic per answer slot. Resist the umbrella term (phishing) whenever a more specific sibling option (smishing, vishing) matches the channel described.
Frequently Asked Questions
Why isn't phishing (B) the second answer instead of impersonation (C)?
Smishing is already a phishing subtype, so pairing B with E would give two overlapping delivery answers and ignore the payroll masquerade. CompTIA reserves phishing for the traditional email vector; the identity deception here is impersonation.
How do I tell smishing apart from vishing in this scenario?
Vishing is voice phishing conducted over a phone call, while smishing uses SMS or text messaging. The stem specifies a text message, so the channel is smishing (E), and vishing (D) is the wrong vector.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →