Finance staff receive an email from the 'CFO' using a lookalike domain. The message requests an urgent gift-card purchase, says the recipient must keep it confidential, and pressures them to skip normal approval steps. What attack is this most likely?

Watering-hole attack targeting employees through a compromised website.

This involves a trusted website being infected, not a deceptive email impersonating an executive.

Smishing attempt delivered through a text message to a mobile phone.

The message is delivered by email, so it is not a text-based social engineering attempt.

Credential stuffing against the CFO's mailbox using previously leaked passwords.

Credential stuffing is a login attack, but the scenario describes a fraudulent message rather than an account takeover attempt.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Business email compromise using executive impersonation and urgency. — Business email compromise is the best answer because the attacker is impersonating a trusted executive to manipulate the recipient into making an unauthorized purchase. The lookalike domain, secrecy demand, and bypassing of approval steps are all hallmarks of this fraud. In practice, BEC often targets finance teams because they are authorized to move money or purchase items quickly when requests appear to come from leadership. Why others are wrong: A watering-hole attack depends on a compromised site visited by the target, not a forged executive email. Smishing is delivered by SMS, not email. Credential stuffing is a login attack against accounts, while this scenario is about social manipulation and fraudulent instructions rather than repeated password attempts.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.