Question 60

Whaling best describes this type of attack.

Whaling is a specific type of phishing attack that targets high-profile individuals, such as CEOs, to deceive individuals into taking unauthorized actions. In this case, the CEO's identity was leveraged to manipulate the secretary into processing an immediate payment.

A) Evil twin

Evil twin refers to a rogue Wi-Fi access point that appears to be legitimate but is used to intercept data from unsuspecting users. This tactic does not apply to the situation described, as the attack was executed via email rather than through a compromised network.

B) Impersonation

While impersonation involves pretending to be someone else to gain trust, it is a broader term that does not specifically capture the nature of this attack. In this instance, the attack specifically targeted a high-level individual and resulted in a financial transaction, thus making it more accurately classified as whaling.

C) Whaling

Whaling is a targeted phishing attack directed at high-value targets, often involving deception to manipulate victims into performing actions that compromise security. In this scenario, the attacker posed as the CEO to facilitate an unauthorized payment, fitting the definition of whaling perfectly.

D) Spear phishing

Spear phishing refers to targeted phishing attacks aimed at specific individuals or organizations, but it generally involves stealing personal information rather than executing financial transactions. In this case, the focus on a CEO and the immediate payment request aligns more closely with whaling than with spear phishing.

Conclusion

Whaling is the most accurate classification for this social engineering attack, as it specifically targets high-level executives to elicit significant actions such as financial transactions. Other options, while related, do not adequately describe the manipulation of the secretary through the CEO's identity for immediate financial gain. Thus, whaling stands out as the definitive correct answer.