Information Technology Specialist (ITS) Cybersecurity Practice Exam

What type of attack requires the use of a phone to obtain personal or sensitive information?

1. Smishing

2. Vishing

3. Phishing

4. Whaling

The correct answer is: Vishing

Vishing, or voice phishing, specifically entails using a phone call to trick individuals into revealing personal or sensitive information. In this type of attack, a malicious actor impersonates a legitimate entity, often claiming to be from a bank, government agency, or another trusted organization. The aim is to manipulate the target into providing valuable data, such as account numbers, social security numbers, or passwords. This technique exploits the direct and personal nature of phone calls, making the victim feel more comfortable disclosing sensitive information than they might via email or other written forms, where it may be easier to recognize the illegitimacy of the request. Understanding the distinction between these concepts is vital for recognizing threats. Smishing relates to phishing attempts via SMS messages, while traditional phishing usually occurs through email. Whaling focuses on high-profile targets, typically executives or individuals with significant access to sensitive information. Therefore, vishing stands out as it requires a direct phone interaction to extract information from the target.