Question 31
Main Page
An employee clicks on a phishing email. What’s the appropriate initial incident response step?
A. Notify law enforcement
B. Re-image the device
C. Contain the affected system
D. Fire the employee
Answer: Contain the affected system
Containment prevents further damage or spread. Eradication and recovery come later.