100-140 Question 338
Select 3A company's helpdesk team receives multiple reports from users about a suspicious email claiming to be from the IT department. The email urges users to click on a link to reset their passwords immediately. Upon investigation, the link redirects to a fake login page. What are the most appropriate actions the helpdesk team should take to prevent further damage and educate users about this threat?
- A
Instruct users to delete the email and avoid clicking on any links within it.
- B
Block the sender's email address and the malicious URL at the email gateway and firewall.
- C
Advise users to respond to the email to confirm its legitimacy before taking action.
- D
Send out a company-wide email alerting employees about the phishing attempt and proper response measures.
- E
Update all user passwords immediately, regardless of whether they clicked the link.
Show answer and explanation
Correct answers: A, B, D
Explanation
Phishing is a common cybersecurity threat that involves tricking users into providing sensitive information. In this scenario, the helpdesk team must act swiftly to contain the threat by instructing users to avoid interacting with the email, blocking the malicious sender and URL, and educating employees about the phishing attempt. These actions address both immediate and future risks while avoiding unnecessary disruptions such as forcing password resets without evidence of compromise.
- A. Correct.
Deleting the email and avoiding interaction with its content is a key step to prevent users from falling victim to the phishing attack.
- B. Correct.
Blocking the sender and the malicious URL at the email gateway and firewall helps stop the spread of the threat and prevents others from accessing the fake login page.
- C. Incorrect.
Responding to the email is not a recommended action because it could validate the email address to the attacker and lead to further targeting.
- D. Correct.
Sending out a company-wide alert educates employees about the phishing attempt and empowers them to respond appropriately, reducing the likelihood of successful attacks.
- E. Incorrect.
Updating all user passwords immediately is unnecessary unless there is evidence that credentials have been compromised. This action could cause unnecessary disruption to operations.