Threats, Vulnerabilities, and Mitigations →easyMultiple ChoiceObjective-mapped

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Exhibit

Email message
From: Payroll Support <payroll-help@vendor-portal.example>
Subject: Urgent: Verify your account now
Body: We detected a payroll issue. Reply with the one-time code we just sent to your phone so we can restore your mailbox today. Failure to act within 10 minutes may suspend access.

Based on the exhibit, what should the employee do first?

⚠ Common exam trap

It's easy for candidates to assume the email is legitimate because it appears to come from an internal department (payroll support) and uses urgent language, leading them to choose Option A or D, when in fact any unsolicited request for sensitive information or action should be treated as a potential phishing attempt.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Report the message through the company’s phishing-report process and do not share the code.

The message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Reply with the code because the request appears to come from payroll support.
Why it's wrong here
Replying with the code—even if the sender appears to be payroll—is dangerous because the email is likely spoofed or from a compromised account. MFA codes are single-use secrets; sharing them allows an attacker to complete an authentication step or reset a password, effectively bypassing the second factor. Legitimate support teams never request one-time codes over email; any such request should be treated as a phishing indicator.
✓
Report the message through the company’s phishing-report process and do not share the code.
Why this is correct
The message is a social engineering attempt that tries to pressure the user into revealing an MFA code. Reporting it quickly helps the security team investigate, warn others, and block related messages. The employee should never provide the code, even if the sender claims to be from payroll or support.
✗
Forward the email to coworkers so they can watch for the same request.
Why it's wrong here
Forwarding the email to coworkers increases the blast radius by spreading the malicious payload or links to additional inboxes. It also bypasses the established incident response chain, meaning the message might not be analyzed or blocked in a timely manner. The correct action is to report the message to the security team, which can extract headers, block the threat, and issue an organization-wide alert if necessary.
✗
Open the attached file to see whether it contains the payroll fix details.
Why it's wrong here
Opening the attached file is unsafe because phishing messages commonly deliver malware via attachments, such as macro-laden Office documents or executable scripts. The attachment could contain ransomware, credential-stealing trojans, or exploit code targeting unpatched software. The employee should avoid engaging with the payload and instead report the message, allowing the security team to detonate the file in a sandboxed environment for analysis.

Go deeper

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question