A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?

Deploying a stronger email spam filter that blocks all emails from unrecognized domains

Email filters may catch known malicious domains, but lookalike domains (e.g., 'cornpany.com') are often new or trusted by the filter, so this control is not consistently effective against CEO fraud.

Requiring multi-factor authentication (MFA) for all corporate email accounts

MFA protects against credential theft, but in this attack the CFO's account is not compromised; the attacker is impersonating the CEO via a spoofed email. MFA does not verify the authenticity of the sender's email address.

Enabling Transport Layer Security (TLS) encryption for all outgoing email communications

TLS encryption protects the confidentiality of email content in transit, but it does not authenticate the sender's identity or prevent spoofing, so it would not stop this attack.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution — This attack is a form of business email compromise (BEC) or CEO fraud, where the attacker spoofs or uses a lookalike domain to impersonate an executive. The most effective prevention is implementing a mandatory out-of-band verification procedure, such as a phone call to a known number, before processing financial requests. Email filtering might catch some spoofed emails, but lookalike domains often bypass filters. Multi-factor authentication (MFA) protects account logins, not email-based impersonation. Encryption ensures confidentiality but does not validate sender identity. Security awareness training is helpful but human error can still occur; a hard validation procedure is more reliable for high-risk actions.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.