nerdexam
CompTIA

SY0-501 · Question #111

Anne, the Chief Executive Officer (CEO), has reported that she is getting multiple telephone calls from someone claiming to be from the helpdesk. The caller is asking to verify her network…

The correct answer is A. Vishing. This scenario describes a vishing attack, where an attacker uses telephone calls to impersonate a trusted entity and trick the CEO into divulging network authentication credentials.

Submitted by lucia.co· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

Anne, the Chief Executive Officer (CEO), has reported that she is getting multiple telephone calls from someone claiming to be from the helpdesk. The caller is asking to verify her network authentication credentials because her computer is broadcasting across the network. This is MOST likely which of the following types of attacks?

Options

  • AVishing
  • BImpersonation
  • CSpim
  • DScareware

How the community answered

(25 responses)
  • A
    76% (19)
  • B
    4% (1)
  • C
    8% (2)
  • D
    12% (3)

Why each option

This scenario describes a vishing attack, where an attacker uses telephone calls to impersonate a trusted entity and trick the CEO into divulging network authentication credentials.

AVishingCorrect

Vishing (voice phishing) is a social engineering attack that uses telephone calls to trick individuals into divulging sensitive information, such as network authentication credentials. The described scenario explicitly states the CEO is receiving 'multiple telephone calls' from someone 'claiming to be from the helpdesk' asking to 'verify her network authentication credentials', perfectly aligning with the definition and characteristics of a vishing attack.

BImpersonation

Impersonation is a broader social engineering technique where an attacker pretends to be someone else, but vishing is the specific term for impersonation conducted over voice communication to solicit information.

CSpim

Spim (spam over Internet Messaging) refers to unsolicited messages sent via instant messaging platforms, which is not relevant to telephone calls.

DScareware

Scareware is malicious software that uses deceptive pop-ups and alarming messages to trick users into purchasing fake software or services, which is distinct from a phone call requesting credentials.

Concept tested: Social engineering (Vishing) attack identification

Source: https://learn.microsoft.com/en-us/training/modules/describe-social-engineering-threats-attacks/2-describe-phishing-vishing-smishing-attacks

Topics

#vishing#social engineering#phone-based attack#credential harvesting

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice