Information Technology Specialist (ITS) Cybersecurity Practice Exam

What type of phishing targets a specific individual within an organization?

1. Phishing

2. Spear phishing

3. Vishing

4. Smishing

The correct answer is: Spear phishing

Spear phishing is a targeted form of phishing that focuses on a specific individual within an organization, often utilizing personal information to make the attack more convincing. Attackers typically gather information about their target—such as job title, responsibilities, and even personal interests—through social media or other publicly available sources. This level of personalization enables them to craft messages that appear credible and trustworthy, increasing the likelihood that the target will engage with the malicious content, such as clicking on a link or providing sensitive information. This differs from general phishing, which casts a wider net and does not focus on particular individuals or their characteristics. Vishing involves voice phishing, where attackers use phone calls to deceive targets, and smishing refers to phishing attempts conducted through SMS text messaging. Both of these methods can be indiscriminate and are not inherently focused on specific individuals within an organization as spear phishing is.