Objective 5.6: Given a scenario, implement security awareness practices
Security+ SY0-701 practice question
An accounts payable clerk receives a text message that appears to come from the CEO. It says the CEO is stuck in a meeting and needs the clerk to buy $2,000 in gift cards right away and text back the card numbers. Based on the company's security awareness training, what should the clerk do FIRST?
- Reply to the text and ask the sender to prove they are the CEO
Replying engages the attacker on a channel they control. They will simply claim to be the CEO, and the reply confirms that the clerk's number is active and that the clerk is responsive.
- Report the message using the company's suspicious-message process(Correct)
Correct. Reporting through the official process, without replying, lets the security team verify the request through trusted channels and warn other staff, and it avoids giving the attacker anything.
- Buy one low-value gift card to test whether the request is genuine
Buying any gift card gives the attacker money and proves the clerk will comply. It tests nothing; a fraudster will happily accept a small card and then ask for more.
- Forward the text to coworkers so they know to watch for similar messages
Forwarding the message spreads the suspicious content and bypasses the security team, who need the report to investigate, block the sender, and send a controlled warning to staff.
Explanation
Urgency, authority, an unusual payment method, and a request to bypass normal processes are classic signs of smishing and impersonation. Awareness training teaches users to recognize these signs, not to engage with the sender, and to report the message through the organization's established reporting channel, so the security team can verify it, warn others, and block the sender.