easyMultiple ChoiceObjective-mapped
SSCP Practice Question: A small business has 50 employees and uses a…
A small business has 50 employees and uses a cloud-based email service. The IT manager receives a report that several employees have been receiving phishing emails that appear to come from the company's CEO. The emails request that employees purchase gift cards and send the codes urgently. Two employees have already complied, losing $500 total. The manager wants to prevent this from recurring. The company has a limited budget and no dedicated security staff. Which of the following actions should the manager take FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable multi-factor authentication (MFA) on the CEO's email account
The most immediate action is to secure the compromised account by enabling multi-factor authentication (MFA) on the CEO's email account. This stops attackers from using stolen credentials to send fraudulent emails, directly addressing the root cause. While other options may help long-term, they do not prevent the current attack vector: Option A (creating a policy) is reactive and does not stop the ongoing threat; Option C (security awareness training) is important but does not prevent the CEO's account from being used; Option D (email filtering) may not catch all spoofed emails and does not address the compromised account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a policy prohibiting gift card purchases
Why it's wrong here
A policy without technical controls is unlikely to stop determined attackers.
- ✓
Enable multi-factor authentication (MFA) on the CEO's email account
Why this is correct
MFA significantly reduces the risk of account takeover, which is the source of these phishing emails.
- ✗
Conduct security awareness training for all employees
Why it's wrong here
Training is important but does not prevent the CEO's account from being compromised and abused.
- ✗
Set up email filtering rules to block emails with the CEO's name
Why it's wrong here
Attackers can easily change the display name, making this control ineffective.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.