A technician receives a report that several employees have received an email appearing to be from the company's IT department asking them to click a link and enter their login credentials. The technician suspects a phishing attack. What is the FIRST step the technician should take according to incident response procedures?

Report the incident to management immediately.

Reporting should occur after initial assessment. Without knowing the scope, reporting prematurely may cause unnecessary alarm or lack of useful information.

Block the sender's email address and delete the email from all inboxes.

Blocking and deleting is a containment step that should be taken after identifying affected users. The first step is always to gather information.

Send a company-wide email educating users on how to spot phishing emails.

Education is important but is a long-term prevention measure. In an active incident, immediate identification and containment take priority.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Identify the affected users and determine if any credentials have been compromised. — The first step in incident response is to identify the scope of the incident. The technician must determine which employees received the email and whether any have already clicked the link or entered credentials. This information guides subsequent containment and remediation actions.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.