You are a cybersecurity apprentice tasked with identifying phishing variants during a simulated attack in your organization's email system. Below are descriptions of email-based attack types. Your task is to identify two correct examples of phishing variants. Which two of the following are examples of phishing? (Choose two)

Phishing is a social engineering attack that uses deceptive electronic communication to trick individuals into divulging sensitive information. Spear phishing and Business Email Compromise (BEC) are two distinct variants of this attack. Spear phishing is a highly targeted form of phishing where attackers research their victims and craft personalized emails. These messages appear to come from a trusted source, increasing the likelihood of success. Business Email Compromise (BEC) is a sophisticated scam that targets organizations. Attackers typically impersonate a high-level executive or a key business partner via email to manipulate an employee into transferring funds or releasing confidential data. Both are prime examples of email-based phishing variants.

A. Man-in-the-middle attack: This is a network eavesdropping attack where an attacker intercepts communications between two parties; it is not a form of social engineering like phishing.
C. Vishing: This is "voice phishing," which uses telephone calls or voice messages to deceive victims. It is not an email-based attack.
E. Watering hole attack: This attack compromises a legitimate website frequented by a target group to infect their computers with malware. It is a web-based, not an email-based, attack.

1. National Institute of Standards and Technology (NIST). Glossary of Terms. CSRC.

Spear Phishing: Defined as "A targeted phishing attack that is customized for a specific individual or organization." (NIST Glossary, "spear phishing")

Business Email Compromise (BEC): Defined as "A type of spear phishing attack in which the attacker impersonates a company executive or other trusted person in order to convince the victim to transfer funds or sensitive information to the attacker." (NIST Glossary, "Business Email Compromise")

Vishing: Defined as "A type of phishing attack in which the attacker uses a voice message or phone call to try to convince the victim to reveal sensitive information." (NIST Glossary, "vishing")

2. Carnegie Mellon University. Introduction to Information Security (Lecture 18: Web Security). Fall 2020.

This courseware distinguishes between different attack vectors. It describes Man-in-the-Middle (MitM) attacks as a network-level interception (Section on "Network Attacker Model") and phishing as a form of social engineering that manipulates the user, with spear phishing being a targeted variant.

3. Al-Hamar, J., Al-saidi, R., & Al-Kaabi, A. (2020). A review of watering hole attack. In 2020 3rd International Conference on Computer Applications & Information Security (ICCAIS) (pp. 1-6). IEEE.

DOI: https://doi.org/10.1109/ICCAIS48893.2020.9096801

This paper defines a watering hole attack as compromising a website trusted by the target group, clearly differentiating it from direct email-based phishing attacks (Section I, Introduction, Paragraph 1).