ITPEC FE Morning April 2023 Question 39

A subject or body that seems related to the recipient's work — a targeted attack tailors the e-mail to a chosen person or organisation so it is opened without suspicion.

In a targeted e-mail attack (spear phishing) the attacker researches the victim and sends what looks like normal business mail, such as an invoice, a meeting notice or a customer enquiry, with a malicious attachment or link. The social engineering is the exploitation of the recipient's trust and routine: a work-related message gets opened.

Answer (b)

Why not others:

• •(a) — "Unsolicited advertising" in the subject marks generic spam, and it makes the mail look less trustworthy, not more.
• •(c) — posing as a financial institution and sending indiscriminately is ordinary mass phishing; indiscriminate is the opposite of targeted.
• •(d) — posing as a collection agency and sending indiscriminately is mass billing fraud, again not aimed at particular recipients.

Key rule: A targeted attack is tailored to a chosen victim, while spam and ordinary phishing are sent indiscriminately; look for which the option describes.

Security · AI-written, may contain errors