Best Responses to a CEO Impersonation Smishing Attack?

Given a scenario, select mitigation techniques or controls to secure an enterprise environment. Given a scenario, implement security awareness practices.

Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are the best responses to this situation? (Choose two).

  1. Cancel current employee recognition gift cards.
  2. Add a smishing exercise to the annual company training. Correct Answer
  3. Issue a general email warning to the company. Correct Answer
  4. Have the CEO change phone numbers.
  5. Conduct a forensic investigation on the CEO’s phone.
Answer Correct answer: B, C — Add a smishing exercise to annual awareness training and issue a company-wide warning about the fraudulent CEO impersonation text demanding gift cards.

Community Votes

BC
100%

100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests whether you select proportionate, people-focused mitigations for a smishing/BEC scam instead of assuming the CEO's phone was compromised; the trap is picking destructive technical actions (number change, forensic imaging) that no evidence in the scenario supports.

A fraudulent CEO impersonation text demanding gift cards is a classic smishing attack against employee judgment, not the executive's device. This page establishes that the two best responses are adding a smishing exercise to annual training (B) and issuing a company-wide warning email (C), while phone-number changes and phone forensics are unwarranted.

The most common wrong answers are E and D, because candidates assume the CEO's phone was hacked or the number spoofed and pick forensic imaging or a new phone number, even though the message came from an unrelated sender with no indication of device compromise.

Community Discussion (14 comments)

Mehsotopes 👍 12 Selected: BC
It is already known that the message is not being sent from the CEO, & awareness of this attack should be known among the company by using the proper training to identify when an attacker is smishing using employee likeness. It is not known if devices are compromised, but if employees are aware of the situation, then that can be figured out as well.
AbdullahMohammad251 👍 6 Selected: BC
A fraudulent message was sent without spoofing the sender's number, indicating the message did not come from a legitimate source and the phone wasn't stolen. Therefore, we don't need to change numbers or conduct a forensic investigation on the CEO's phone. We will first inform the employees about the current smishing attack. Then, adjust the annual Company training to include awareness of and protection against similar smishing attacks.
IT_dude_in_training 👍 1 Selected: BC
B. Add a smishing exercise to the annual company training Smishing is a type of phishing attack via text messages. Incorporating it into annual company training will help employees recognize such fraudulent attempts and improve overall security awareness. C. Issue a general email warning to the company This will quickly alert all employees about the specific phishing attempt and provide guidance on how to handle such situations, reducing the risk of future incidents.
JackExam2025 👍 1 Selected: BC
The best responses are to train employees through a smishing exercise and alert the entire company through an email warning to prevent further attacks.
habbeysax 👍 1 Selected: BC
A fraudulent message was sent without the sender's number being spoofed, confirming it did not originate from a legitimate source and that the phone has not been stolen. Consequently, there is no need to change numbers or conduct a forensic investigation on the CEO's phone. Our immediate action will be to inform employees about the ongoing smishing attack. Additionally, we will update the annual company training to include awareness and prevention of similar smishing attacks.
JRCHENRY 👍 1 Selected: BC
Proper training to identify smishing and Employee awareness.
ProudFather 👍 1 Selected: BC
BC seems to be the most reasonable options. As the company with need to be trained and made aware of such attacks so they do not fall victim to this in the future.
famuza77 👍 3 Selected: B
How not implementing Mobile Device Management is gonna help on the situation? Technical measures are more importante than annual trainings? stop asking GTP for responses and think
dbrowndiver 👍 3 Selected: BC
In this scenario, employees have received a fraudulent text message impersonating the CEO, aiming to trick them into purchasing and sending gift cards. The attack is a classic example of smishing, a type of phishing conducted through SMS Add a smishing exercise to the annual company training-Training employees through realistic exercises will prepare them for recognizing smishing attempts in the future. They will learn how to spot red flags in messages that seem urgent and authoritative but are suspicious in nature. Issue a general email warning to the company-o Alerting the organization helps contain the threat and reduces the chance of employees inadvertently engaging with the scam. It is an immediate response that mitigates risk by stopping the scam in its tracks.
Segunmx 👍 1 Selected: BC
These are the correct answers. General email warnings to the employees and there’s a need for more trainings.
AbdullahMohammad251 👍 2 Selected: BC
A fraudulent message was used, and the sender's number was not spoofed, meaning the message didn't come from a legitimate source. The question didn't mention the phone was stolen either. Therefore, we don't need to change numbers or conduct a forensic investigation on the CEO's phone. First, we will inform the employees about the current smishing attack. Then, we will adjust our annual company training to include protection against smishing attacks.
hasquaati 👍 2 Selected: BC
BC, I eliminated the incorrect questions to this one.
shady23 👍 2 Selected: BC
B. Add a smishing exercise to the annual company training. C. Issue a general email warning to the company.
Yoez 👍 2
Correct Answer: BC

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The scenario describes smishing: a text-message social engineering attack impersonating the CEO with a gift-card pretext, a well-known business email compromise (BEC) variant. Because the fraud directly targets employee judgment, the proportionate controls are awareness-focused. Option C, a general email warning, immediately tells staff that the fraudulent text is circulating so no one buys or sends gift cards. Option B, adding a smishing exercise to annual training, hardens the workforce long-term and is the standard awareness-practice control for this attack type. Both are low-cost, non-disruptive, and directly counter the attack vector described in the question.

Why the Other Options Are Wrong

Option A is wrong because cancelling current employee recognition gift cards does not touch the fraud — the attackers are asking for new cards to be purchased and forwarded, so the legitimate recognition program is simply disrupted for no security gain. Option D is wrong because nothing in the scenario says the sender's number was spoofed or the CEO's phone was cloned; changing the number is disruptive, expensive, and solves no stated problem. Option E is wrong for the same reason: forensic imaging of the CEO's phone presumes a device compromise that the question never establishes, and it is a disproportionate response to an external impersonation text. Options A, D, and E all act on facts that are not in evidence.

Community Comment Notes

Consensus in the comments is strongly behind B and C, and the reasoning is sound. As Mehsotopes explained, awareness of the attack should be spread through proper training so staff can spot smishing that abuses an executive's likeness. AbdullahMohammad251 made the decisive observation that "A fraudulent message was sent without spoofing the sender's number", which is exactly why options D and E fail. One dissenter, famuza77, selected only B and argued that technical measures matter more than annual training, but a warning email plus awareness training are the correctly scoped pair the question asks for, and the question requires two selections.

Answer Statement Rationale

Choosing B and C keeps the response inside the two categories that actually mitigate smishing: rapid communication to potential victims and durable awareness training. It avoids the exam trap of escalating to endpoint forensics or telecom changes when the only confirmed fact is that a fraudulent text was received.

Official Reference

Exam Strategy

On "best response" multi-select questions, eliminate any option that assumes a compromise the scenario never states — here, a hacked or spoofed CEO phone. Then pick the two options that address people and process (warning users, awareness training), since they directly counter the smishing vector at the lowest cost.

Frequently Asked Questions

Why isn't a forensic investigation of the CEO's phone the right response?

The sender's number was not spoofed and nothing in the scenario says the CEO's device was compromised, so imaging the phone investigates a threat that was never indicated.

Why warn the whole company instead of cancelling existing gift cards?

Cancelling legitimate recognition gift cards does nothing to stop the scam, while a company-wide warning helps staff recognize the fraudulent texts already in circulation.

More SY0-701 FAQ →

Related Analysis

Which of the following consequences would a retail chain mos

A-Grade

Which of the following threat actors is the most likely to b

S-Grade

An administrator finds that all user workstations and server

A-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide