Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Kestrel Logistics receives an email, apparently from its CFO, asking a finance clerk to urgently pay a new supplier. The email address is subtly altered and the clerk has been named from the company's public website. Which threat is this best described as?

This is spear phishing, a targeted social engineering attack. The attacker impersonates a senior executive and uses a named employee to trick them into paying money. It relies on deception rather than overwhelming systems, encrypting files or exploiting database input flaws.

  1. ASpear phishing (a targeted social engineering attack)Correct
  2. BA distributed denial-of-service attack
  3. CRansomware infection through an unpatched server
  4. DA SQL injection attack on the payment database

Explanation

The message is personalised to a named employee and impersonates a senior executive to induce a payment, which is targeted phishing (spear phishing or whaling). DDoS aims to overwhelm availability, ransomware encrypts data, and SQL injection exploits web application input; none is described.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions