Cert Master

KT-EMS Business email compromise (BEC)

Legal notices a forged CEO email approving acquisition NDA sharing. Besides legal, who must be engaged FIRST?

Multiple choice — select one answer

Answer choices

  1. a. Physical security for CCTV only, without security or identity team coordination per policy.
  2. b. Patch management team for WSUS, without security or identity team coordination per policy.
  3. c. Security operations to hunt for mailbox rules forwarding and similar threads
  4. d. Facilities for parking passes, without security or identity team coordination per policy.

Architectural breakdown & explanation

BEC often includes hidden inbox rules; SOC hunts prevent ongoing exfiltration.

Correct answer(s): c. Security operations to hunt for mailbox rules forwarding and similar threads

Exam domain: Business email compromise (BEC) (25% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Email Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications