SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?
⚠ Common exam trap
A common mix-up: candidates choose a technical control like MFA or spam filters, overlooking that the attack exploits human trust and domain spoofing rather than account compromise, so the most effective control is a procedural one that bypasses the email channel entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution
The attack is a business email compromise (BEC) using a lookalike domain. A policy requiring verbal verification via a known phone number adds a human out-of-band check that bypasses the email channel entirely, preventing the fraudulent transfer even if the email appears legitimate. This control directly addresses the social engineering aspect of the attack, which technical controls alone cannot fully mitigate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploying a stronger email spam filter that blocks all emails from unrecognized domains
Why it's wrong here
A stricter spam filter that blocks unrecognized domains is insufficient because attackers commonly register lookalike domains (e.g., 'cornpany.com') that are new and may pass domain reputation checks. Additionally, many spoofing attacks use display-name spoofing from legitimate or compromised accounts, which filters do not reliably catch. Blocking all unrecognized domains would also risk dropping legitimate business email, making it an impractical and unreliable control.
When this WOULD be correct
In a scenario where an organization receives a high volume of phishing emails from completely unknown or newly registered domains, and the attack relies on the recipient not recognizing the sender's domain, a stronger spam filter blocking all emails from unrecognized domains would be most effective.
- ✗
Requiring multi-factor authentication (MFA) for all corporate email accounts
Why it's wrong here
MFA protects against credential theft, but in this attack the CFO's account is not compromised; the attacker is impersonating the CEO via a spoofed email. MFA does not verify the authenticity of the sender's email address.
When this WOULD be correct
In a scenario where an attacker gains access to a legitimate executive's email account (e.g., via phishing) and uses it to send fraudulent wire transfer requests, MFA would prevent the initial account compromise, thus stopping the attack.
- ✓
Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution
Why this is correct
This is correct because email authentication cannot fully prevent CEO fraud, especially when the attacker uses a lookalike domain or spoofed display name. Requiring a verbal confirmation via a pre-established phone number obtained from a trusted directory, not the email itself, creates an out-of-band verification channel. This ensures the financial instruction is genuine before any transfer is executed, directly mitigating the impersonation risk.
- ✗
Enabling Transport Layer Security (TLS) encryption for all outgoing email communications
Why it's wrong here
TLS encryption only protects the confidentiality of email content while in transit between mail servers, providing no mechanism to authenticate the sender's identity or verify the integrity of the message source. A spoofed email that impersonates the CEO is still delivered over an encrypted TLS connection, so the attack would succeed exactly the same way. This control addresses eavesdropping, not impersonation, and therefore does nothing to prevent the fraudulent transfer.
When this WOULD be correct
A question where the threat is interception of sensitive financial data during email transmission, such as an attacker capturing unencrypted emails containing wire transfer instructions. In that case, enabling TLS would prevent the attacker from reading the content.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before executionCorrect answer▾
Why this is correct
This is correct because email authentication cannot fully prevent CEO fraud, especially when the attacker uses a lookalike domain or spoofed display name. Requiring a verbal confirmation via a pre-established phone number obtained from a trusted directory, not the email itself, creates an out-of-band verification channel. This ensures the financial instruction is genuine before any transfer is executed, directly mitigating the impersonation risk.
✗Deploying a stronger email spam filter that blocks all emails from unrecognized domainsWrong answer — click to see why▾
Why this is wrong here
The email came from a lookalike domain ('cornpany.com'), not an unrecognized domain; a spam filter blocking unrecognized domains would not catch this because the domain is similar to a known one, and the filter might not block it if the domain is not in the blocklist.
★ When this WOULD be the correct answer
In a scenario where an organization receives a high volume of phishing emails from completely unknown or newly registered domains, and the attack relies on the recipient not recognizing the sender's domain, a stronger spam filter blocking all emails from unrecognized domains would be most effective.
Why candidates choose this
Candidates may think that any email from an external or suspicious domain should be blocked, but they overlook that the attack uses a domain that is very similar to a legitimate one, which would bypass typical spam filters.
✗Requiring multi-factor authentication (MFA) for all corporate email accountsWrong answer — click to see why▾
Why this is wrong here
MFA protects against unauthorized access to email accounts, but in this attack, the email came from a spoofed domain (ceo@cornpany.com), not a compromised account. The CFO was not tricked by a lack of MFA but by a deceptive sender address.
★ When this WOULD be the correct answer
In a scenario where an attacker gains access to a legitimate executive's email account (e.g., via phishing) and uses it to send fraudulent wire transfer requests, MFA would prevent the initial account compromise, thus stopping the attack.
Why candidates choose this
Candidates often associate MFA with preventing all email-based attacks, overlooking that this specific attack relies on domain spoofing rather than account takeover.
✗Enabling Transport Layer Security (TLS) encryption for all outgoing email communicationsWrong answer — click to see why▾
Why this is wrong here
TLS encryption protects data in transit from eavesdropping but does not verify the sender's identity or prevent spoofed email addresses, so it would not stop a phishing attack that uses a lookalike domain.
★ When this WOULD be the correct answer
A question where the threat is interception of sensitive financial data during email transmission, such as an attacker capturing unencrypted emails containing wire transfer instructions. In that case, enabling TLS would prevent the attacker from reading the content.
Why candidates choose this
Candidates may confuse encryption with authentication, thinking that securing the communication channel also verifies the sender's legitimacy, or they may overestimate the scope of TLS protections.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Social Engineering Attacks
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Business email compromise
Business email compromise is a sophisticated cyberattack where a criminal impersonates a trusted person or organization via email to trick the victim into transferring money or revealing sensitive information.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.