220-1102 Question 432
Single answerSmishingA company's help desk receives several calls from employees who got a text message on their personal smartphones stating: "Payroll issue detected. Verify your direct deposit immediately at hr-payroll-secure.com or your paycheck may be delayed." One employee already tapped the link but did not enter any information. As the technician, which action should you recommend FIRST to best address this smishing attempt?
- A
Tell the employee to reply to the text and ask the sender to confirm the request is legitimate
- B
Instruct the employee to delete the text, avoid further interaction, and report the message through the company's security process
- C
Have the employee forward the text to all staff so others can watch for the message
- D
Advise the employee to factory reset the phone immediately because tapping the link means the device is definitely infected
Show answer and explanation
Correct answer: B
Explanation
This scenario describes smishing, which is phishing delivered through SMS or text messaging. Common signs include urgency, threats of negative consequences, requests to verify account information, and links to look-alike domains. In A+ Core 2, the expected response is to recognize the social engineering technique and follow safe incident-handling behavior: do not engage, do not provide credentials, and report the message through established company procedures. If a user clicked the link, additional follow-up may include checking for redirected login pages, credential exposure, unexpected downloads, browser prompts, or mobile configuration/profile installation, but the FIRST action remains to stop interaction and report it. This aligns with general security awareness guidance from organizations such as CISA and NIST, which recommend verifying requests through trusted channels and reporting phishing/smishing attempts rather than responding directly.
- A. Incorrect.
This is incorrect. Replying to a suspicious text confirms the number is active and increases engagement with the attacker. In a smishing scenario, users should avoid interacting with the sender, links, or any requested contact method in the message. A common misconception is that asking for verification is safe, but the attacker controls the conversation.
- B. Correct.
This is correct. The message is a classic smishing attempt: it uses urgency, a business-themed pretext, and a link to push the recipient into taking immediate action. The best first step is to stop interaction, delete or isolate the message after preserving any needed evidence according to company policy, and report it through the organization's security or incident-reporting process. If the user only tapped the link and did not provide credentials or install anything, reporting and monitoring are appropriate initial actions.
- C. Incorrect.
This is incorrect. Although warning others may seem helpful, forwarding the message spreads the malicious content and can create additional risk. The proper approach is to report it through approved internal channels so security or IT can notify employees safely and consistently.
- D. Incorrect.
This is incorrect. Tapping a link does not automatically mean the device is definitely infected. While mobile compromise is possible, especially if a malicious site prompted a download or exploit, the scenario does not establish that malware was installed. A factory reset is a drastic step and is not the best first action without further signs of compromise or direction from security procedures.