Exam CS0-002 topic 1 question 324 discussion

Here is my analysis: - B and D are discarded because this is not a security analyst responsibility. - The EXTERNAL tag is used to review an email deeper for potential phishing activity. - The sender domain seems to be right (we would have to analyze the email header to discard an open smtp relay for example, I'm talking base on my experience, but that is not available on this question lol). - In the body message the "CEO" is asking to make a purchase and the gift cards purchased should be shared as an image in the reply but for what? I think this is the major red flag. And also, I gotta mention that "urgency" is taking place here ("asap") this is a common social engineering technique. - In the item mentioned above I would reach out to CEO to validate this activity before taking the decision to release or delete the email because I don't discard their account has been compromised. I have reasons to doubt about the origin or intentions of this e-mail to take the decision of releasing it, so I would delete it and block the sender, but again there are some other steps I would follow before taking this decision but due to the lack of context I think this is the right answer (C).

Why not D?

I agree, C