You've received multiple reports about a suspicious email from someone who is pretending to be from your organization's human resources department. The email is prompting employees to click a link…

Question

Options

• AUse the security investigation tool to search for users who received the suspicious email, and
• BUse the security investigation tool to action the suspicious email and select Mark message as
• CCreate an activity rule to alert administrators to similar emails from that sender.
• DNotify all employees and request that they report this email as spam.

• A
  70% (21)
• B
  3% (1)
• C
  10% (3)
• D
  17% (5)

Explanation

When a phishing or spoofing email has been distributed to employees, the most effective remediation is to use the security investigation tool to search for all users who received the suspicious email, then take bulk action - such as deleting or quarantining those messages - across all affected mailboxes. This removes the threat from everyone's inbox in one centralized action. Option B also uses the investigation tool but 'Mark as spam' is less definitive than full deletion/quarantine for a confirmed phishing campaign. Option C (creating an activity rule) only helps with future similar emails, not the existing ones already delivered. Option D (notifying employees) is inadequate because it relies on users taking action and leaves the malicious email active in inboxes.

No community discussion yet for this question.