Which of the following attacks can be used to exploit a vulnerability that was created by untrained users?

Spear-phishing is a targeted social engineering attack that succeeds specifically because untrained users lack the awareness to identify deceptive sender identities, urgent or manipulative language, and malicious attachments. When an untrained user opens a malicious file, they trigger the attack vector that proper security awareness training is designed to prevent. This attack exploits human behavior - a vulnerability that is directly created and sustained by inadequate user training.

A DoS attack using IoT devices exploits misconfigured or unpatched device firmware and network infrastructure weaknesses, not the knowledge gap of individual end users.

An evil twin access point is a network interception attack that can affect even security-aware users and relies on proximity and wireless infrastructure vulnerabilities rather than user training gaps.

Domain hijacking exploits weaknesses in domain registrar account security or DNS infrastructure and is a technical attack that is not dependent on end-user training levels.