200-201 Question 77
Select 3A security analyst is investigating a phishing attack on their organization. During the investigation, they need to communicate with a user who received a suspicious email. Which of the following actions should the analyst take to ensure effective user interaction while gathering information about the incident?
- A
Explain the potential risks of the email and request the user to forward it to the security team.
- B
Instruct the user to delete the email immediately without further discussion.
- C
Ask the user to describe any actions they took after receiving the suspicious email, such as clicking links or downloading attachments.
- D
Use technical jargon to quickly explain the situation and avoid unnecessary details to save time.
- E
Reassure the user that they are not at fault and guide them through any necessary remediation steps.
Show answer and explanation
Correct answers: A, C, E
Explanation
Effective user interaction during a cybersecurity investigation is crucial. Security analysts should aim to gather information, educate users on risks, and maintain clear and reassuring communication. This approach helps in building trust with users and ensures the collection of valuable evidence while guiding them through the necessary actions to mitigate risks.
- A. Correct.
Explaining the risks and requesting the user forward the email helps the analyst gather critical evidence while educating the user on the potential threat.
- B. Incorrect.
Instructing the user to delete the email immediately without discussion could result in losing valuable evidence needed for the investigation.
- C. Correct.
Asking the user about their actions provides insights into whether the system may have been compromised or if further investigation is required.
- D. Incorrect.
Using technical jargon can confuse the user and may hinder effective communication, especially if they do not have a technical background.
- E. Correct.
Reassuring the user fosters trust and ensures they remain cooperative during the incident response process. Guiding them through remediation steps also supports a swift resolution.