Which of the following is an example of a spear phishing attack?

Spear phishing is characterized by targeting a specific, known individual with a customized message rather than sending generic lures to a mass audience; directing an SMS-based social engineering attack at a named executive satisfies this definition because the attacker has identified the individual target and tailored the attack to that person, making the delivery channel secondary to the targeting specificity.

Targeting a specific team is a group-level campaign that lacks the single-individual targeting that defines spear phishing; attacking a department is closer to a standard phishing campaign than a precision attack on one identified person.

Dropping USB keys for random users is a physical removable-media attack against an unspecified population, which is the opposite of the precise, individual-focused targeting that defines spear phishing.

A watering hole attack compromises websites or resources frequented by an organization's users and relies on victims visiting those sites, rather than directly and precisely targeting a specific named individual.