312-50V10 · Question #88
In this attack, a victim receives an e-mail claiming from PayPal stating that their account has been disabled and confirmation is required before activation. The attackers then scam to collect not…
The correct answer is D. Antivirus, anti-spyware, and firewall software can very easily detect these type of attacks. This scenario describes a phishing attack; the incorrect statement is D because antivirus, anti-spyware, and firewall tools generally cannot reliably detect phishing since it exploits human trust rather than malware.
Question
In this attack, a victim receives an e-mail claiming from PayPal stating that their account has been disabled and confirmation is required before activation. The attackers then scam to collect not one but two credit card numbers, ATM PIN number and other personal details. Ignorant users usually fall prey to this scam. Which of the following statement is incorrect related to this attack?
Options
- ADo not reply to email messages or popup ads asking for personal or financial information
- BDo not trust telephone numbers in e-mails or popup ads
- CReview credit card and bank account statements regularly
- DAntivirus, anti-spyware, and firewall software can very easily detect these type of attacks
- EDo not send credit card numbers, and personal or financial information via e-mail
How the community answered
(39 responses)- A3% (1)
- B3% (1)
- C5% (2)
- D90% (35)
Why each option
This scenario describes a phishing attack; the incorrect statement is D because antivirus, anti-spyware, and firewall tools generally cannot reliably detect phishing since it exploits human trust rather than malware.
This is a correct defensive recommendation - replying to unsolicited emails asking for financial information is a primary vector for phishing success.
This is a correct defensive recommendation - attackers often include fake phone numbers in phishing emails to further deceive victims.
This is a correct defensive recommendation - regular account reviews help detect unauthorized transactions resulting from phishing.
Phishing is a social engineering attack that tricks users into voluntarily submitting sensitive information through fraudulent websites or emails. Traditional security tools like antivirus and firewalls are designed to detect malicious code or unauthorized network traffic, not deceptive content that mimics legitimate communications, making the claim that they 'very easily detect' phishing attacks false.
This is a correct defensive recommendation - email is an unsecured channel and should never be used to transmit sensitive financial data.
Concept tested: Phishing attack characteristics and limitations of technical controls
Source: https://www.cisa.gov/tips/st04-014
Topics
Community Discussion
No community discussion yet for this question.