A city help desk receives a phone call from someone claiming to be the CIO who urgently demands a password reset for a privileged account and refuses to use the ticket portal. Which threat vector best describes this attempt?
Select an answer to reveal the explanation.
Short Explanation
That urgent "CIO on the phone" act is classic vishing — social engineering over voice, not email or a shady website. Help desk staff get pressed to skip the ticket portal and reset a privileged password on the spot. Treat the call channel itself as the attack surface.
Full Explanation
Vishing is social engineering delivered over a live voice channel. The attacker impersonates a trusted authority—here a CIO—and uses urgency plus refusal of normal process to coerce a privileged password reset. CompTIA Security+ treats voice call as its own threat vector because the channel bypasses email filters, ticket portals, and many identity workflows that staff expect to protect high-risk actions. Help-desk culture that "just wants to help" becomes the exploit path when verification is skipped.
Smishing fails the scenario because the delivery medium is SMS text messaging, not a phone conversation. The municipal help desk received a spoken call with real-time pressure, which is a different social-engineering surface than a text link or one-time code lure.
A watering-hole attack compromises a website that the target population already trusts and routinely visits, then infects browsers that land there. Nothing in this incident describes a poisoned municipal forum, intranet page, or industry site—only a coercive voice call.
Business email compromise centers on fraudulent email, often with lookalike domains, to redirect payments or harvest credentials. This attempt never uses email or payment redirection; the vector is verbal impersonation against the service desk.
Exam caveat: Security+ distinguishes phishing (email), smishing (SMS), and vishing (voice). Do not collapse them into a generic "social engineering" answer when the question names the channel. Authority pretenses and urgency cues are common across all three, but the correct label tracks the medium.
Operational check for a city help desk: require out-of-band verification for any privileged reset requested by phone—callback to a known CIO number from the directory, ticket creation first, and dual approval for privileged accounts. Train staff that refusing the portal is itself a red flag, and log/report coercive reset calls as security incidents rather than customer-service failures.