Cert Master

KT-EMS Business email compromise (BEC)

AP receives email changing ACH details for a top vendor; phone number in signature is new. Step?

Multiple choice — select one answer

Answer choices

  1. a. Process the change if the email uses the vendor logo and familiar font styling, without security or identity team coordination per policy.
  2. b. Reply in-thread to confirm because the sender domain looks similar to the real one, without security or identity team coordination per policy.
  3. c. Forward the request to the CEO for one-click approval to meet quarter-end deadlines, without security or identity team coordination per policy.
  4. d. Call the vendor using the phone number in the ERP vendor master, not the email

Architectural breakdown & explanation

BEC payment changes must be verified out-of-band with trusted contact data.

Correct answer(s): d. Call the vendor using the phone number in the ERP vendor master, not the email

Exam domain: Business email compromise (BEC) (25% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Email Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications