SIMULATION Approximately 100 employees at your company have received a phishing email. As a security analyst, you have been tasked with handling this situation. INSTRUCTIONS Review the information…

Submitted by cyberguy42· Mar 6, 2026CompTIA Security+ Domain 4.0 – Security Operations: Specifically covers incident response procedures (4.4), analyzing indicators of compromise, and using log data to investigate and contain security incidents caused by social engineering attacks such as phishing.

Question

SIMULATION Approximately 100 employees at your company have received a phishing email. As a security analyst, you have been tasked with handling this situation. INSTRUCTIONS Review the information provided and determine the following: 1. How many employees clicked on the link in the phishing email? 2. On how many workstations was the malware installed? 3. What is the executable file name of the malware? If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Answer:

Exhibits

Explanation

This is a simulation-based question from the CompTIA Security+ exam that requires candidates to analyze log files, email headers, endpoint detection reports, or SIEM data to extract specific incident response metrics. The correct answers are derived by carefully reviewing the provided simulation data: typically a proxy/web filter log shows how many employees clicked the phishing link, an endpoint protection or AV log reveals how many workstations had malware installed, and a process/file execution log identifies the malware executable name. These answers cannot be stated definitively without the actual simulation interface, but the methodology involves correlating HTTP GET requests to the malicious URL (clicks), successful payload execution events (installations), and the specific .exe filename flagged in alerts.

Topics

#Incident Response#Phishing Analysis#Log Analysis#Malware Investigation

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice