A help desk technician receives a call from a user who reports that they received an email asking them to click a link and enter their corporate credentials to 'verify their account.' The user clicked the link and entered their username and password. According to incident response best practices, what should the technician do FIRST?

Reset the user's password to a temporary value

Resetting the password is part of remediation, but the incident must first be escalated so that the security team can assess if other accounts or systems have been affected.

Change the user's password immediately

While changing the password is important, it should be done within the incident response framework to ensure proper tracking and communication. The first step is escalation to the security team.

Disable the user's account to prevent further access

Disabling the account is a containment action, but it should be performed by or coordinated with the security team to ensure a coordinated response. The first step is escalation.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Escalate the incident to the security team according to the incident response plan — When a user has potentially compromised their credentials through a phishing attack, the incident should be escalated to the security team or incident response team as per the organization's incident response plan. They have the authority and tools to investigate, contain, and remediate the incident. Simply changing the password or disabling the account without investigation may miss other indicators of compromise.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.