Identifying Business Email Compromise Scenarios

SY0-701 By islever Editorial Last updated

Explain common threat vectors and attack surfaces. Given a scenario, apply common security techniques to computing resources.

Short answer

A An employee receives a gift card request in an email that has an executive’s name in the display field of the email.

Question

Which of the following scenarios describes a possible business email compromise attack?
  1. An employee receives a gift card request in an email that has an executive’s name in the display field of the email. Correct Answer
  2. Employees who open an email attachment receive messages demanding payment in order to access files.
  3. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.
  4. An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal.

Key Takeaways

BEC focuses on social engineering and financial fraud through impersonation, whereas other options describe malware delivery or credential theft.

This question tests recognition of Business Email Compromise (BEC) by distinguishing it from ransomware and general phishing. The correct answer identifies CEO fraud involving gift card requests.

Common mistake: Candidates may choose C because it involves social engineering, but it lacks the immediate financial transaction element (gift cards/wire transfers) that defines typical BEC scenarios in certification exams.

Expert Analysis

The question asks to identify a scenario describing a Business Email Compromise (BEC) attack. BEC is a specific type of social engineering where an attacker impersonates a trusted entity—such as a CEO, vendor, or partner—to deceive employees into transferring funds, purchasing gift cards, or divulging sensitive information. The key characteristic of BEC is the use of spoofed email addresses or compromised accounts to create a false sense of authority and urgency, typically avoiding malware delivery in favor of direct human manipulation.

Option A describes an employee receiving a gift card request from an email displaying an executive’s name. This is a textbook example of 'CEO Fraud,' a subset of BEC. The attacker exploits the hierarchical trust within an organization, using the executive's identity to pressure the victim into making unauthorized financial transactions. The lack of technical indicators (like links or attachments) highlights the social engineering nature of the attack, which is central to BEC definitions.

Option B involves ransomware behavior (encrypting files for payment), which is distinct from BEC. Option C describes a credential harvesting attempt via social engineering, often categorized as phishing or spear-phishing, but lacks the immediate financial fraud component typical of BEC scenarios in exam contexts. Option D is a classic phishing attack targeting login credentials through a fake portal. While BEC emails can contain malicious links, the defining feature here is the impersonation for financial gain, making A the most precise fit for the specific term 'Business Email Compromise' rather than general phishing.

Exam Strategy

When analyzing email-based threats, look for the intent behind the message. If the goal is immediate financial transfer or purchase (gift cards, wire transfers) using a spoofed high-authority identity, classify it as BEC. If the goal is installing malware or stealing passwords, classify it as ransomware or phishing respectively. Prioritize the financial exploitation aspect when 'BEC' is the target concept.

Frequently Asked Questions

What is the difference between BEC and Phishing?

Phishing is a broad term for deceptive messages aiming to steal data or install malware. BEC is a specific subtype of phishing focused on financial fraud through impersonation of trusted figures like executives or vendors.

Why is Option C not considered BEC?

Option C describes credential harvesting via social engineering. While related, BEC specifically emphasizes fraudulent financial transactions or changes to payment details, which Option C does not include.

More SY0-701 FAQ →

Community Votes

A
65%
B
35%

65% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 114 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 114

  1. lauren2wright 👍 44
    C. In a BEC attack, the attacker typically impersonates a high-ranking executive or authority figure within the organization and requests sensitive information or actions from employees. In this case, the HR director is requesting log-in credentials for a cloud administrator account, which is a classic example of BEC where the attacker seeks to gain access to privileged accounts through deception.
  2. TheMichael 👍 15
    Answer: A. It could be C if there wasn't a better option, but a BEC is about impersonating, and in the answer choice C it doesn't specify that someone is acting as hr, whereas A is a better choice because they are clear that someone is being impersonated. Your boss requests documents all the time, they don't need to demand it. The choice is clearly A.
  3. Aces155 👍 13
    But the exec’s name being in a field doesn’t indicate there’s a compromise. Receiving a direct email from the HR director indicates that the HR director’s email has been compromised.
  4. Snooozey 👍 11
    The best answer is C. The HR Director is not your boss, but someone high in your organization. They are asking for cloud administrator credentials, which has nothing to do with HR, so there is a chance that the directors email account has been compromised and the hacker is now hoping that you will just give in to their request because of the higher rank. In this situation you would follow up with the HR Director in person to determine if they actually made the request and if they really need the credentials for a legitimate reason.
  5. luisar3 👍 8
    Option A is only saying the name appears in the display text not that it is from that person. C says it is FROM that person of authority.
Show 25 more comments
  1. pedrwc7 👍 4 Answered C
    A. An employee receives a gift card request in an email that has an executive’s name in the display field of the email. (It did not state that the email is from a company internal email address account) B. Employees who open an email attachment receive messages demanding payment in order to access files. (It did not state that the email is from a company internal email address account) C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account. (It did state that the email is from a company internal email address account) D. An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal. (It did not state that the email is from a company internal email address account)
  2. AbdullahMohammad251 👍 4 Answered C
    Option A describes an executive whaling attack Option B describes a ransomware attack Option D describes a phishing attack to harvest credentials Option C describes a BEC attack. Business email compromise (BEC) attacks involve an attacker gaining access to a legitimate business email account or impersonating a trusted figure within an organization to deceive employees into taking actions that compromise security. The service desk employee received an email from the legitimate HR director account. This means the HR director's email account has been compromised, and the attacker is attempting to access sensitive information by requesting login credentials from the service desk employee.
  3. tladytea 👍 4 Answered D
    C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account. Here’s the reasoning: • Business Email Compromise (BEC) attacks typically involve a cybercriminal impersonating a trusted person, such as an executive or a manager, to trick employees into divulging sensitive information, making unauthorized wire transfers, or performing actions that compromise the security of the organization. • Scenario C fits this description because it involves an attacker impersonating the HR director to trick a service desk employee into providing sensitive log-in credentials. This is a common tactic in BEC attacks.
  4. Grouthorax 👍 4
    Both A and C can be classified as a BEC because they both impersonate an executive or high-level authority. However, with the details we are given, we should assume that the attacker in scenario A is targeting only the recipient to fool them into sending them money. In scenario C, the attacker is trying to gain access to an administrative account which would likely cause a lot more harm to an organization.
  5. a4e15bd 👍 4
    The fact that the email has the executive's name in the display field strongly suggest impersonation which is a hallmark of BEC. Both A and C involve impersonation which is central to BEC with scenario A being a class BEC because it is specifically leveraging the executives identity to request gift card which is a common BEC tactic.
  6. bambam123 👍 4 Answered C
    A. if it comes from excutive email. but it says "DISPLAY NAME" only! meaning the exceutive emails not been compromised. C. is clearly came from the email of "HR DIRECTOR" meaning that email address is compromised asking for anything they need to do more damage.
  7. MAKOhunter33333333 👍 4 Answered A
    Everywhere I read from credible online sources like FBI, CloudFlare, Cisco, etc., state that BEC is financially motivated and is the main goal, not compromising credentials. Professor Messer even mentions financial fraud.
  8. ShaunN 👍 4 Answered C
    it is the only option where the email comes from within the company.
  9. Kevhack787 👍 3 Answered A
    A. ✅ "An employee receives a gift card request in an email that has an executive’s name in the display field of the email." Classic BEC: Impersonation of a high-ranking official to trick an employee into buying gift cards. B. "Employees who open an email attachment receive messages demanding payment in order to access files." This is ransomware, not BEC. C. "A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account." This is closer to phishing for credential theft, not the typical goal of BEC (which is financial fraud). D. "An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal." This is also phishing, not BEC. BEC usually does not involve links or malware—just psychological manipulation.
  10. Philco 👍 3 Answered A
    Business Email Compromise (BEC): is a social engineering attack where a cybercriminal impersonates a trusted person (usually an executive, boss, or vendor) via email to trick an employee into: Transferring money Buying gift cards Sending sensitive data The key characteristics of BEC are: No malware involved No malicious links necessarily Relies purely on trust and authority deception Often uses display name spoofing (the name looks right but the actual email address is fake) C. HR director asking for credentials Credential harvesting is phishing, not BEC — BEC targets money or gift cards, not login details
  11. CaptainMan 👍 3 Answered C
    They are asking for cloud administrator credentials, which have nothing to do with HR, so there is a chance that the director's email account has been compromised and the hacker is now hoping that you will just give in to their request because of the higher rank. In this situation, you would follow up with the HR Director in person to determine if they actually made the request and if they really need the credentials for a legitimate reason.
  12. 8f23125 👍 3 Answered A
    Option | Scenario | Type of Attack A | Impersonates an executive asking for gift cards | ✅ BEC attack (common tactic) B | Ransom message after opening an attachment | ❌ Ransomware, not BEC C | Credential theft request from HR director | ❌ Phishing or Social Engineering, but not necessarily BEC D | Link to a fake email login portal | ❌ Phishing, not BEC
  13. karimelmasry42 👍 3 Answered C
    HR should not ask for cloud admin credentials. the fact that it is sent from an HR email address means that the address is compromised. It is not A because the Display Field can contain any name, it does not indicate that an email has been compromised.
  14. Lacuna 👍 3 Answered C
    C. Requires compromise of the business email. Answer A can be performed with publicly available information
  15. MistyUnicorn 👍 3
    A is FED, and c is BEC
  16. Etc_Shadow28000 👍 2 Answered C
    A business email compromise (BEC) attack typically involves an attacker impersonating a legitimate business email account to deceive an organization or its employees into making unauthorized transactions or divulging sensitive information. A. - This is a common form of BEC, where the attacker impersonates an executive to request a gift card purchase or other financial action. B. - This describes a ransomware attack, not a BEC. Ransomware typically encrypts files and demands a ransom for decryption. C. - This scenario is a BEC attack, where the attacker impersonates an HR director to gain sensitive credentials. D. - This describes a phishing attack. While phishing can be part of a BEC attack, it is not a BEC attack itself unless it involves the specific impersonation and fraudulent intent typically seen in BEC. The scenario that best describes a possible business email compromise attack is: C.
  17. ZhugeLiang 👍 2 Answered A
    Email account compromise (EAC) vs BEC In many cases the objective of a BEC attacker and EAC attacker are the same: They want to steal money, data or other sensitive information. However, the key difference is that in a BEC attack, the hacker is merely posing as a trusted figure, such as a business executive, lawyer, or important vendor, usually via a spoofed email account. That person then attempts to direct an employee or other person to take a given action, such as wiring funds to the attacker’s account. In EAC attacks, however, the attacker breaches a legitimate email account and acts as the owner of that account. With access to real credentials, the actor is able to conduct fraudulent activity and bypass multi-factor authentication tools.
  18. ezmoney 👍 2
    The Answer is A: Read carefully...The attacker impersonates an executive or high-level authority within the company to deceive employees into taking actions like sending money. This scenario describes an attempt to trick employees into purchasing gift cards by pretending to be an executive, which is a classic example of BEC. Example: An attacker sends an email claiming to be from the CEO asking the recipient to buy gift cards and send the details back, leveraging the EXECUTIVE'S NAME to create a sense of urgency and authority.
  19. Gadoof 👍 2
    It's A because THE Classic BEC attack comes in the form of an attacker emailing an internal asking for them to purchase gift cards with the company debit card for a 'future meeting that they don't have time to handle.' This is a scam as it's not really the CFO or whoever and they'll ask you to leave the gift cards 'outside' or somewhere where the attacker can take them. It's also so low in monetary value that nobody cares to investigate, thus enabling the attackers to continue operating with impunity. C is way more than a BEC.
  20. Wagone 👍 2 Answered C
    The correct answer is: C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account. Here's why: This scenario most accurately reflects a Business Email Compromise (BEC) attack, which typically involves: Impersonation of a high-level executive or trusted individual. Social engineering tactics to trick employees into transferring money, sharing sensitive information, or credentials. A focus on email-based deception, rather than malware or phishing links.
  21. wahsan 👍 2 Answered A
    A Business Email Compromise (BEC) attack is a form of social engineering where an attacker impersonates a trusted person—often a CEO, executive, or vendor—to trick employees into sending money, gift cards, or sensitive information. Common BEC examples include: ✔ Gift card requests ✔ Wire transfer requests ✔ Invoice fraud ✔ Payroll or direct deposit changes In this scenario, the attacker uses the executive's display name to make the email appear legitimate and asks for gift cards—a classic BEC tactic.
  22. Empath 👍 2 Answered C
    BEC attacks rely on social engineering and impersonation of executives, vendors, or trusted individuals to trick employees into transferring money, sending sensitive data, or providing credentials. They typically do not use malware or attachments. Not A. While a gift card request with an executive’s name is also a form of BEC (gift card scam), the scenario described in C is a more textbook case because it involves impersonating a trusted authority to steal credentials. Therefore the answer is C
  23. Maximux1804 👍 2 Answered A
    A. This scenario describes a Business Email Compromise (BEC) attack, which is a type of phishing attack that relies on social engineering. In a BEC attack, attackers impersonate a trusted individual (often an executive) and use their name or email address to request sensitive information, payments, or, as in this case, gift cards. These attacks often rely on urgency and authority to trick employees into acting without verifying the request.
  24. HazyG5224 👍 2
    Answer is C. A doesn’t make sense to me think about it people can change there display name that’s the Key word that stood out. If it mention the email of an executive that’s different, but it didn’t the only one that make sense when talking about a business comprise is C because if you get a email from HR that’s something you would be familiar with but requesting my logins are kind of of that sets a red flag in the company
  25. JT619 👍 2 Answered A
    According to studying and Google: The best answer is A. An employee receives a gift card request in an email that has an executive's name in the display field of the email.. Explanation: A Business Email Compromise (BEC) attack often involves impersonating a high-level executive to trick employees into performing actions like purchasing gift cards or transferring funds, and this scenario closely matches that definition.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide