220-1102 Operational Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attempt to recall the email from the user's email client

  Why it's wrong here

  Attempting to recall the email is an Exchange/Outlook client feature that sends a recall request to the recipient's mailbox, but it is unreliable across domains and does not guarantee deletion, especially if the recipient has already read the message or if the email is on an unmanaged device. More importantly, initiating a recall before notifying the incident response team can alter or destroy forensic evidence, such as message headers, routing logs, and mailbox copies, which are needed to determine the scope and cause of the incident. The recall action should only be considered after the appropriate team has been engaged and has approved this containment step.

• ✗

  Delete the email from the user's sent items to reduce visibility

  Why it's wrong here

  Deleting the email from the sender's sent items only removes the local copy in the user's mailbox; it does not remove, recall, or quarantine the email from the recipient's mailbox, the mail server's transport logs, or any journaling/archiving system. This action also degrades critical evidence, as the sent item is often a key artifact for forensic analysis, showing the exact content, recipients, and timestamp. Moreover, deleting the sent item may be viewed as an unauthorized tampering with data, which could violate legal hold or evidence-preservation obligations, making the technician's action counterproductive to the investigation.

• ✗

  Contact the recipient directly and ask them to delete the email

  Why it's wrong here

  Contacting the recipient directly without coordination with the incident response team is risky because the recipient may react emotionally, forward the email to others, or delete it, which can further spread the data and destroy evidence. The technician also lacks the authority and context to determine whether the incident is a data breach, a misdelivered sensitive message, or a security violation, so any external communication could trigger procedural or legal problems. Direct outreach should be left to the incident response team, which can follow proper notification protocols, preserve a chain of custody, and issue legally compliant messaging if recipient contact is warranted.

• ✓

  Escalate the incident according to the company's incident response policy

  Why this is correct

  Escalating the incident according to the company's incident response policy is the correct first action because it triggers the formal process of notification, analysis, containment, and evidence preservation. A help desk technician is not equipped to assess the full scope or severity of a possible data exfiltration or accidental disclosure, and taking unilateral actions like recall or deletion can destroy forensic data. Escalation to a designated incident response team or manager ensures that trained personnel can implement appropriate hold measures, coordinate with legal/compliance, and determine the proper escalation path, which protects the organization from further harm and regulatory penalties.

Go deeper

Related to this question