Understanding Spear Phishing Attacks:
Spear phishing is a targeted cyberattack where attackers send personalized emails to trick individuals into providing sensitive data (e.g., passwords, financial information).
Unlike regular phishing, which casts a wide net, spear phishing is highly customized and often appears to come from a trusted source.
Why Option C Is Correct?
The scenario describes a highly personalized email (related to a golf membership) that tricks the recipient into clicking a malicious hyperlink and entering sensitive data.
This matches the definition of a spear phishing attack, where an attacker tailors a scam specifically for an individual.
IIA GTAG 16 – Data Analytics and ISO 27001 emphasize the need for security awareness training to mitigate such threats.
Why Other Options Are Incorrect?
Option A (Website attack causing a server crash):
This describes a Denial-of-Service (DoS) attack, not spear phishing.
Option B (Generic recorded message requesting password data):
This is vishing (voice phishing), not spear phishing. Spear phishing relies on personalized emails.
Option D (Fake social media investment opportunity):
This describes mass phishing, which targets multiple users, unlike spear phishing, which is highly targeted.
Spear phishing is a targeted attack that uses personal details to deceive individuals, making option C the best choice.
IIA GTAG 16 and ISO 27001 emphasize cybersecurity awareness to prevent such attacks.
Final Justification:IIA References:
IIA GTAG 16 – Data Analytics in Cybersecurity Audits
ISO 27001 – Cybersecurity Best Practices
NIST SP 800-61 – Incident Response Guidelines for Phishing Attacks
