Question 48

Whaling is occurring in this scenario.

The situation describes an attack where the caller, pretending to be the Chief Financial Officer, attempts to deceive the user into approving a funds transfer. This tactic aligns with whaling, which targets high-profile individuals within an organization to exploit their authority.

A) Vishing

Vishing, or voice phishing, involves using phone calls to trick individuals into providing sensitive information. While this scenario does involve a phone call, the primary characteristic of vishing is the request for personal data, rather than exploiting someone's authority for financial gain, which is the essence of whaling.

B) Whaling

Whaling specifically targets high-level executives or individuals with significant authority, as seen in this case. The caller impersonating the CFO is attempting to exploit their position to obtain a funds transfer, making this option the most accurate description of the attack occurring.

C) Insider threat

An insider threat refers to risks posed by individuals within the organization who may misuse their access. In this case, the threat does not originate from within the organization but rather from an external source impersonating a high-ranking official, thus eliminating this option.

D) Evil twin

An evil twin attack involves creating a fraudulent Wi-Fi network that mimics a legitimate one to capture sensitive information. This scenario does not involve network impersonation or data capture through a fake network, making this option irrelevant to the situation described.

Conclusion

Whaling is the most fitting classification of the attack in this scenario, as it involves impersonating a senior executive to manipulate a subordinate into executing a financial transaction. Other options either mischaracterize the nature of the attack or are unrelated to the methods used in this specific case.