Which Attack Vector Uses Fake HR Onboarding Email Links?
A new employee logs in to the email system for the first time and notices a message from human resources about onboarding. The employee hovers over a few of the links within the email and discovers that the links do not correspond to links associated with the company. Which of the following attack vectors is most likely being used?
Answer
Correct answer: B — The fake HR onboarding email with mismatched hyperlinks is a social engineering (phishing) attack vector, not a compromised business email account.
Community Votes
55% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the difference between an attack vector (the method used, here social engineering/phishing) and an attack surface (business email), and the trap is picking 'business email' just because the lure arrived by email.
A new hire sees an onboarding email from HR whose links resolve to non-company domains — a classic phishing lure. This page establishes that the attack vector is social engineering (B), not business email, an unsecured network, or default credentials.
Choosing 'Business email' because the message is an email. That option describes an attack surface and, read as business email compromise, requires an attacker to control a legitimate mailbox — the scenario shows a spoofed/fake HR message, not a hijacked corporate account.
Community Discussion (17 comments)
c80f5c5
👍 17
Selected: A
Business email compromise (BEC) is an email-based social engineering attack Social engineering refers to all the techniques used to coerce or talk a victim into revealing information that someone can use to perform malicious activities and render an organization or individual vulnerable to further attacks Answer: A- Business email
Twphill
👍 10
Selected: B
Social engineering is an attack vector, while Business email is an attack surface. If it said Business Email Compromise, that would be an attack vector.
Linas312
👍 2
Selected: B
Typical bad wording.. IF its a hr compromised account then could be A? but even a is it BEC they are referring to? vague for no reason, they can really blindly pick either A or B and decide which they will accept..
WifiWan
👍 1
Selected: A
biz email
mejestique
👍 1
Selected: B
The correct answer is: B. Social engineering Explanation: This scenario describes a phishing attack, a type of social engineering where an attacker sends fraudulent emails pretending to be from a trusted source (in this case, human resources). The mismatched links suggest an attempt to deceive the employee into clicking a malicious link, possibly leading to credential theft or malware installation. Other options explained: A. Business email – Likely refers to Business Email Compromise (BEC), which involves targeted attacks on executives or finance personnel rather than generic phishing. C. Unsecured network – There is no indication that the employee is on an insecure network; the issue is the deceptive email content. D. Default credentials – This applies to systems left with manufacturer-set passwords, which is unrelated to phishing emails. Since the attacker is attempting to manipulate human behavior to gain access, this is a social engineering attack.
TmNvrWts
👍 1
Selected: B
Why not the others? A. Business email (compromise) – This involves an attacker gaining control of a legitimate business email account, but in this case, the email appears to be a fake rather than a compromised real account. C. Unsecured network – An unsecured network could allow data interception, but it wouldn’t cause misleading links in an email. D. Default credentials – This refers to using factory-set usernames and passwords, which is unrelated to this phishing attempt.
pindinga1
👍 2
Selected: A
Business email compromise (BEC) is an email-based social engineering attack
esko636
👍 1
Selected: B
This is a social engineering attack done through phishing. Phishing typically involves sending mass emails to a large number of recipients, aiming to trick them into clicking on malicious links or providing sensitive information. The email in this scenario seems to fit this pattern, as it contains suspicious links that do not correspond to the company's legitimate links. Business Email Compromise (BEC), on the other hand, is more targeted. It often involves attackers gaining access to a legitimate business email account and using it to send fraudulent emails to specific individuals within the organization. These emails usually request actions like transferring funds or sharing confidential information. BEC attacks are generally more sophisticated and personalized compared to phishing.
Damique
👍 1
Selected: B
It is not business email because this term refers to emails sent using an organization's domain and infrastructure, not necessarily indicative of an attack.
BevMe
👍 1
Selected: B
Social Engineering is right.
3dk1
👍 1
Selected: A
This lines up with A
PAWarriors
👍 4
Selected: A
The correct answer is A. > This is an example of Business Email Compromise (BEC). BEC is a type of phishing attack that usually targets businesses by using one of their internal email accounts to get other employees to perform some kind of malicious actions on behalf of the attacker. In this scenario the email came from human resources, indicating that this is a BEC.
Ambaj
👍 3
Selected: B
B. Social engineering
ofolan
👍 5
Selected: B
B. Social engineering Social engineering involves manipulating individuals into divulging confidential information or performing actions that compromise security. In this case, the email containing suspicious links is an example of a phishing attempt, where attackers try to deceive the employee into clicking on malicious links that may lead to fraudulent sites or compromise their credentials.
17f9ef0
👍 2
Selected: B
Answer is B
a73231e
👍 6
I think that this question is a bit tricky in its language and its options of available answers. I would agree with A if it actually said " Business Email Compromise" but it simply says business email. B would be the correct answer because its actually mentioning a form of attack. Attack vector is literally referring to what kind of attack is being shown.
Glacier88
👍 4
Selected: B
Social engineering: This refers to techniques used to manipulate people into performing actions or divulging confidential information. In this case, the attacker is using a legitimate-looking email from human resources to trick the new employee into clicking on malicious links. Business email compromise (BEC): While BEC can involve emails from legitimate-looking senders, it typically targets high-profile individuals or organizations for financial gain. In this case, the target is a new employee, and the goal seems to be to compromise their system.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The message impersonates a trusted internal party (HR), leans on an onboarding pretext aimed at an employee too new to know the real URL conventions, and contains links that do not resolve to company domains. That is phishing — a social engineering technique, and SY0-701 treats social engineering as a threat vector, exactly what the question asks for. The deception targets the human rather than a technical weakness: no malware is confirmed, no credential store is breached, and no misconfiguration is described. Option B therefore matches the wording "attack vector" most precisely. The misleading hyperlinks are the tell that the sender's goal is to induce a click, the core of social engineering.Why the Other Options Are Wrong
A, "Business email," names an attack surface rather than the vector; the exam blueprint lists business email compromise under surface/social-engineering categories, and true BEC requires the attacker to be operating inside a legitimate account, which nothing in the scenario establishes. C, "Unsecured network," could allow interception or manipulation of traffic, but a plaintext path would not by itself produce an intact HR email containing rewritten destinations — no rogue AP or lack of TLS is mentioned. D, "Default credentials," refers to unchanged vendor-supplied logins on devices and applications, and the employee logged in with their own account; the anomaly lives entirely in the message content, not in how access was obtained.Community Comment Notes
Twphill draws the cleanest distinction, writing "Social engineering is an attack vector, while Business email is an attack surface," and adding that true BEC would need the fuller label to count as a vector. Others leaning toward A, such as c80f5c5, argue that "Business email compromise (BEC) is an email-based social engineering attack," which is true but describes the parent category, not the literal option offered. Linas312 calls the item out for vague wording, noting a test taker "can really blindly pick either A or B," while TmNvrWts observes the email "appears to be a fake rather than a compromised real account" — the decisive detail that keeps A out of contention.Official Reference
Exam Strategy
When asked for the attack vector, name the technique used against the victim (phishing/social engineering), not the medium it traveled over. Watch for distractor options that rename an attack surface — email, network, endpoint — since SY0-701 deliberately separates vectors from surfaces.
Frequently Asked Questions
Why isn't business email the correct attack vector here?
Business email is an attack surface, and business email compromise requires the attacker to control a legitimate mailbox. The scenario shows spoofed HR links, not a hijacked corporate account.
How should a new employee verify suspicious onboarding links?
Hover to read the true destination, then verify the message through a known HR contact or the corporate portal instead of clicking the link or replying.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →