Question

An end-user has reported that a legitimate sender sent an unexpected email stating the user needed to urgently update the password account information to a vendor website. Once the user clicked on the URL in the email, the user was taken to a landing page to update the user's credentials. The user entered the credentials, despite noticing the URL was slightly misspelled. What happened in this situation

Answer 1

Answer:

D) The user is a victim of a phishing scam, and the attacker spoofed or compromised the sender's email address and spoofed the website.

Answer 2

Group of answer choices.

A) The attacker has sniffed the user's packets on the user's local network and has captured the user's credentials in plain text.

B) The user is a victim of a pharming attack by using social engineering to trick the user into clicking a link that redirected their traffic to a spoof website.

C) The user is the victim of an impersonation attack, where the attacker used intimidation by coaxing the target and engaging with them by putting them at ease.

D) The user is a victim of a phishing scam, and the attacker spoofed or compromised the sender's email address and spoofed the website.

Answer:

D) The user is a victim of a phishing scam, and the attacker spoofed or compromised the sender's email address and spoofed the website.

Explanation:

Social engineering can be defined as an art of manipulating people, especially the vulnerable to divulge confidential information or performing actions that compromises their security.

Basically, it is a manipulative strategy or technique that involves the use of deceptive and malicious activities on unsuspecting victims in order to gain unauthorized access to their confidential or private information for fraud-related purposes. Some examples of social engineering attacks include quid pro quo, spear phishing, baiting, tailgating, water-holing, vishing, pretexting, phishing, etc.

Phishing is an attempt to obtain sensitive information such as usernames, passwords and credit card details or bank account details by disguising oneself as a trustworthy entity in an electronic communication usually over the internet.

Furthermore, phishing is a type of fraudulent or social engineering attack used to lure unsuspecting individuals to click on a link that looks like that of a genuine website and then taken to a fraudulent web site which asks for personal information.

This ultimately implies that, the user in this scenario is a victim of a phishing scam, and the attacker spoofed or compromised the sender's email address and spoofed the website to make it look like a credible, authentic and original one.