What is the first action they should take?

An employee clicks on a link in an email that they later suspect to be a phishing attempt.

What is the first action they should take?
A . Continue working and monitor the system for any unusual activity
B . Immediately change all their passwords
C . Disconnect their computer from the internet and report the incident to IT security
D . Delete the email to prevent further risk

View Answer

Answer: C

Explanation:

Correct Answer. C. Disconnect their computer from the internet and report the incident to IT security Disconnecting the computer helps prevent any potential malware from communicating with its controller or spreading to other systems, and reporting to IT security allows for a proper response to the incident.

Option A is incorrect because continuing to work without taking action could allow potential malware or a breach to worsen.

Option B is incorrect because changing passwords immediately without first securing the system might not prevent further damage if malware has been installed.

Option D is incorrect because simply deleting the email does not mitigate the risk if the link has already been clicked.