GreenTech Inc. is a mid-sized company with 500 employees. The company uses Microsoft Exchange Online for email and has implemented a security policy that requires all employees to report suspicious emails to the security team. The security team uses a phishing simulation tool to train employees. In the past month, several employees have reported receiving emails that appear to be from the CEO requesting urgent wire transfers. The security team has blocked the sender domains and updated the email filters. However, one employee fell for the latest scam and transferred $50,000 to an account before reporting it. The security incident response plan states that any monetary loss must be reported to the board within 24 hours. The security analyst receives the report on Monday morning. What should the analyst do first based on the policy and best practices?

Question

Accepted Answer

Immediately contact the bank to attempt to reverse the wire transfer. The immediate priority is to attempt to recover the funds. Contacting the bank to reverse the wire transfer should be the first step because there is a chance to stop or reverse the transaction if done promptly. Notifying the board (C) is required within 24 hours but is secondary to attempting recovery. A full forensic investigation (B) can be launched later, but it does not prevent monetary loss. Disabling email access (A) is overly disruptive and not the first action; it may be considered after containment, but the immediate need is to try to recover the funds.

Answer

Disable email access for all employees to prevent further attacks

Answer

Launch a full forensic investigation to identify the source

Answer

Notify the board within the 24-hour window as per policy

200-201 GreenTech Inc Practice Question

Why each option matters

Option-by-option breakdown

Related to this question