CS0-003 Question #292: Real Exam Question with Answer & Explanation

Question

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

Options

• AScan the employee's computer with virus and malware tools
• BReview the actions taken by the employee and the email related to the event
• CContact human resources and recommend the termination of the employee
• DAssign security awareness training to the employee involved in the incident