ISC2 CC Security Operations Practice Question
A security analyst is reviewing email gateway logs and notices a message that passed authentication checks but contains a URL pointing to a look-alike domain registered three days ago. The message appears to come from the organization's CEO and requests an urgent wire transfer. Which type of attack is MOST likely being attempted?
⚠ Common exam trap
Test-takers frequently confuse BEC with generic phishing, but BEC specifically targets financial transactions through executive impersonation, often without malicious attachments or links to credential-harvesting sites.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Business email compromise (BEC)
Business email compromise (BEC) is a social engineering attack where cybercriminals impersonate executives or trusted partners to trick employees into transferring funds or sharing sensitive information. The combination of an urgent wire transfer request, a spoofed CEO identity, and a newly registered look-alike domain strongly indicates BEC. Other attack types do not align with the described email-based deception and financial motive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS attacks inject malicious scripts into web pages viewed by other users. This scenario describes an email with a link to a look-alike domain, not a script injection into a trusted website. The goal appears to be financial fraud through impersonation, not stealing session cookies or executing scripts in a victim's browser.
- ✗
SQL injection
Why it's wrong here
SQL injection involves inserting malicious SQL statements into input fields to manipulate a database. This scenario involves an email message with a URL, not a web application input field. There is no database interaction described. The attack vector is social engineering via email, not exploitation of a database vulnerability.
- ✓
Business email compromise (BEC)
Why this is correct
The scenario describes a spoofed executive identity, an urgent financial request, and a newly registered look-alike domain. These are hallmarks of business email compromise, where attackers impersonate executives to trick employees into transferring funds or revealing sensitive data. The message passing authentication checks suggests the attacker may have compromised a legitimate account or used a carefully crafted domain that bypasses some filters.
- ✗
Distributed denial-of-service (DDoS) attack
Why it's wrong here
A DDoS attack aims to overwhelm a service with traffic, causing downtime. The scenario describes a targeted email with a fraudulent financial request, not a flood of network traffic. There is no indication of service disruption or resource exhaustion. The focus on a look-alike domain and urgent wire transfer points to social engineering, not availability attacks.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Social engineering
Social engineering is the psychological manipulation of people into divulging confidential information or performing actions that compromise security.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.