David, an incident responder, investigates an email-based breach where the CFO's email account was compromised...

This incident is a classic spear phishing attack, where a targeted individual is deceived into entering credentials on a fraudulent login page. The ECIH Email Security module describes spear phishing as highly targeted and often tailored to specific roles, such as executives.

Option D is correct because the CFO was targeted with a convincing fake Microsoft 365 login prompt, leading to credential theft. The use of valid credentials afterward confirms successful social engineering rather than technical exploitation.

Option A involves email flooding. Option B redirects traffic via DNS manipulation. Option C targets mobile messaging platforms.

Recognizing spear phishing is critical because it informs remediation steps such as credential resets, MFA enforcement, and executive awareness training, all emphasized in ECIH guidance.