SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Verify the request through a known out-of-band contact method for the vendor.

  Why this is correct

  A compromised email thread is fully controlled by the attacker, so any reply or embedded link stays within an untrusted channel. Using a known out-of-band method—such as a phone number previously documented in the vendor master file, or a secure portal that was already established—creates a second, independent channel the attacker cannot intercept or modify. This directly defeats business email compromise (BEC) by verifying the authenticity of the bank detail change before any sensitive update is executed.

• ✓

  Pause the payment and require secondary approval before any bank details are updated.

  Why this is correct

  Requiring a second approver enforces separation of duties, ensuring that no single compromised mailbox or user can authorize a fraudulent payment change. This control introduces a human checkpoint that can spot anomalies, and it creates an audit trail that proves the change was reviewed. It also buys time for the organization to validate the request, significantly narrowing the window in which a fraudulent transfer can be initiated.

• ✓

  Report the message through the security and vendor-validation process.

  Why this is correct

  Reporting through the security and vendor-validation process allows incident response teams to correlate indicators of compromise—such as the sender address, phishing links, or language patterns—with other known campaigns and proactively block similar messages across the organization. It also enables the company to contact the vendor directly through trusted channels to confirm whether the requested change is legitimate, preventing other departments from falling for the same scam. This transforms a single suspicious email into actionable threat intelligence rather than leaving it as an isolated action.

• ✗

  Reply in the same thread because the address and signature look legitimate.

  Why it's wrong here

  An attacker who has compromised a legitimate vendor mailbox (or spoofed the domain) can continue the conversation, forge headers, and alter subsequent instructions, so replying provides zero cryptographic or procedural proof of identity. Display names, domains, and signatures can all be recreated exactly, and the entire conversation remains under attacker control. Without a separate, known communication channel, replying only confirms the attacker’s ability to impersonate the vendor and does nothing to validate the request.

• ✗

  Process the change immediately to avoid delaying the vendor relationship.

  Why it's wrong here

  Urgency is a classic social-engineering trigger in BEC attacks, and acting without verification turns a suspicious request into a confirmed financial loss; once a wire or ACH transfer is initiated, funds are rarely recoverable. The short delay required for validation is almost always less costly than the fraudulent payment itself, and legitimate vendors expect verification for sensitive banking changes. Immediate processing bypasses all detective and preventive controls, leaving the organization fully liable for the loss.

Go deeper

Related to this question