SY0-701 Question 479
Single answerPhishing: Campaigns , Recognizing a phishing attempt , Responding to reported suspicious messagesA company's security awareness program encourages employees to report suspicious emails by using a phishing-report button in the mail client. On Monday morning, several users report a message that appears to come from the IT team and says, "Your mailbox will be disabled today unless you revalidate immediately." The message uses urgent language, contains a link to a lookalike domain, and asks users to sign in with their corporate credentials. The security analyst confirms the email is malicious and finds that a few employees already clicked the link. Which action should the analyst take FIRST to best limit the impact of this phishing campaign?
- A
Send a companywide reminder about how to recognize phishing emails and schedule additional awareness training
- B
Block the sender, associated URLs/domains, and similar indicators in the email security gateway and begin removing the message from user mailboxes
- C
Ask all employees to forward the suspicious email to the help desk so the team can compare message headers manually
- D
Wait to take technical action until endpoint logs confirm whether malware was downloaded from the phishing site
Show answer and explanation
Correct answer: B
Explanation
This scenario tests practical handling of a reported phishing campaign: recognizing phishing indicators and responding appropriately once a suspicious message is confirmed as malicious. The email shows classic phishing signs, including urgency, impersonation of IT, a lookalike domain, and a request for credentials. In a real environment, the best immediate response is containment: block known indicators of compromise in email and web controls and remove the message from mailboxes to prevent further interaction. After that, responders should investigate impacted users, reset potentially compromised credentials, review sign-in logs, and determine whether additional controls such as MFA challenges, URL blocking, or user notifications are needed. This approach is consistent with common incident response best practices such as those described by NIST SP 800-61, which emphasizes prompt containment after identification, and with general email security guidance that prioritizes rapid removal of malicious messages and blocking of associated indicators during phishing incidents.
- A. Incorrect.
This is a useful follow-up action, but it is not the first step when an active phishing campaign is already underway. Awareness reminders help improve recognition of phishing attempts, but they do not immediately contain the threat for users who have not yet clicked. In an incident response context, rapid containment is prioritized before longer-term training improvements.
- B. Correct.
This is the best first action because it focuses on immediate containment of an active phishing campaign. Once the analyst has validated that the message is malicious, blocking the sender and known malicious URLs/domains at the email security gateway and related controls helps prevent additional deliveries and clicks. Removing or quarantining the email from user inboxes further reduces exposure. This aligns with standard incident response practices: identify, contain, and then proceed to eradication and recovery. After containment, the analyst can investigate affected users, reset credentials if needed, and review for follow-on compromise.
- C. Incorrect.
This is incorrect because forwarding suspicious messages can increase exposure and may alter evidence handling, depending on how the mail system processes forwards. The company already has a phishing-report mechanism, which is the appropriate reporting channel. Once the analyst has confirmed the message is malicious, the focus should shift to containment rather than asking more users to interact with the email.
- D. Incorrect.
This is incorrect because delaying containment allows the phishing campaign to continue reaching or tricking more users. Even if no malware was downloaded, credential harvesting alone is a significant risk. Security teams should not wait for full endpoint confirmation before blocking clearly malicious phishing indicators. Immediate action is especially important when the email uses urgency and credential theft tactics.