SY0-701 Question 480
Select 2Phishing: Campaigns , Recognizing a phishing attempt , Responding to reported suspicious messagesA company's help desk receives several reports about an email titled "Updated MFA Policy - Immediate Action Required." The message appears to come from the IT team, urges users to click a link to avoid losing access, and uses a domain that differs slightly from the company's real domain. One employee already clicked the link and entered credentials before realizing the page looked unusual. The security analyst must take the MOST appropriate next steps to respond to the reported suspicious messages and limit impact from the phishing campaign. Which TWO actions should the analyst take FIRST?
- A
Reset the affected user's password, revoke active sessions, and investigate whether the account shows signs of unauthorized access
- B
Use the email security platform to quarantine or block the message across mailboxes and preserve a copy for analysis
- C
Send a company-wide message telling users to ignore the email, but wait to take technical action until more reports are received
- D
Delete the reported email from the help desk mailbox so employees do not accidentally open it during the investigation
- E
Add the sender's display name to a block list and consider the phishing campaign contained
Show answer and explanation
Correct answers: A, B
Explanation
The best initial response combines account containment for the employee who entered credentials and message containment for the broader campaign. In a phishing incident, analysts should quickly identify indicators of compromise, isolate or block malicious emails, and protect any potentially compromised accounts. Common signs of phishing in this scenario include urgency, a look-alike domain, and a credential-harvesting link. These are well-established indicators highlighted in security awareness guidance from organizations such as CISA and NIST. NIST incident handling guidance emphasizes containment, evidence preservation, and analysis as early priorities, while phishing response best practices commonly include disabling or resetting compromised credentials, revoking sessions, reviewing logs for misuse, and removing or quarantining malicious emails from other inboxes.
- A. Correct.
Correct. Because a user already submitted credentials, the analyst should immediately contain potential account compromise by resetting the password, revoking sessions or tokens where applicable, and reviewing authentication activity for suspicious access. This directly addresses the highest-risk impact of a credential-harvesting phishing attack.
- B. Correct.
Correct. A phishing campaign affecting multiple users requires rapid containment at the email layer. Quarantining or blocking the message across mailboxes helps prevent additional clicks, and preserving a sample supports analysis, rule tuning, and incident documentation. This is a standard response when suspicious messages have already been reported by several users.
- C. Incorrect.
Incorrect. User notification can be helpful, but delaying technical containment is not appropriate once a phishing campaign is identified and at least one user has entered credentials. Best practice is to take immediate containment actions first, then communicate broadly as part of the incident response process.
- D. Incorrect.
Incorrect. Deleting the message from the help desk mailbox does not address the phishing campaign in user inboxes and may remove useful evidence. Security teams should preserve artifacts such as headers, URLs, and message content for analysis rather than discard them.
- E. Incorrect.
Incorrect. Blocking only the sender's display name is not sufficient because display names are easy to spoof and do not uniquely identify the sending source. Effective containment should focus on the actual sending domain, URLs, message indicators, and affected accounts, not just the visible name.