SY0-701 General Security Concepts Practice Question
An employee receives an email that appears to be from the CEO and asks for an urgent wire transfer. The sender address is slightly different from the real company address. What is the best first action?
⚠ Common exam trap
CompTIA often tests the concept that verifying through the same compromised channel (e.g., replying to the email) is insufficient, and the trap here is that candidates may think replying to ask for confirmation is a safe step, when in fact it only engages with the attacker.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the request using a separate trusted method
The email exhibits classic signs of a business email compromise (BEC) attack, where the sender address is spoofed or slightly altered. Verifying the request through a separate, trusted method—such as calling the CEO directly or using a known internal communication channel—bypasses any compromised email system and confirms the legitimacy of the request. This aligns with the principle of out-of-band verification, which is a key defense against phishing and social engineering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Complete the transfer because it came from an executive
Why it's wrong here
Email display names are trivially spoofed, and an attacker can forge the CEO's name to create a false sense of authority. BEC (Business Email Compromise) attacks often impersonate executives to pressure employees into unauthorized wire transfers. Acting on authority alone bypasses standard verification controls and can result in significant financial loss.
- ✗
Reply to the email asking if it is real
Why it's wrong here
Replying to the same email thread keeps you within the attacker's controlled communication channel, allowing them to further manipulate the conversation. If the sender address is spoofed, your reply goes directly to the attacker's mailbox, giving them another opportunity to reinforce the fraudulent request. Real verification requires a separate trusted method, such as a phone call to a known internal number.
- ✓
Verify the request using a separate trusted method
Why this is correct
The safest first action is to verify the request through a separate trusted channel, such as calling the CEO using a known internal number or checking with a supervisor. This helps confirm whether the message is legitimate without relying on the suspicious email itself. Urgent money requests are a common social engineering tactic, so independent verification is essential.
- ✗
Forward it to the whole department for awareness
Why it's wrong here
Forwarding the email department-wide does not verify its legitimacy and instead amplifies the threat by spreading the phishing message to more potential victims within your organization. This indiscriminate distribution can create confusion, and if the email contains malicious links or attachments, it increases the chance that another employee will fall victim. The appropriate action is to report the suspicious email to your security team for formal investigation.
Go deeper
Related to this question
Learn chapter
Zero Trust Architecture
Key term
Business email compromise
Business email compromise is a sophisticated cyberattack where a criminal impersonates a trusted person or organization via email to trick the victim into transferring money or revealing sensitive information.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.