A technician receives an email at work that appears to come from the company's payroll department. The email states that the recipient must verify their direct deposit information by clicking a link and logging in with their corporate credentials. The technician notices the sender's email address is 'payroll@cornpany.com' instead of 'payroll@company.com'. What is the BEST first action for the technician to take?

Click the link to see if the website looks legitimate

Clicking the link is dangerous. Even if the technician does not enter credentials, the act of clicking can trigger malware downloads or confirm the email address to the attacker. Security best practices prohibit clicking on links in suspected phishing emails.

Delete the email and ignore it

Deleting the email without reporting it fails to alert the security team. The attacker may target other employees with the same scheme. It is important to report such incidents to prevent a broader compromise.

Reply to the email asking for clarification

Replying confirms the email address is active and may lead to further social engineering. Attackers often use these replies to gather more information or to escalate the attack.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Forward the email to the company's security team for investigation — The email shows clear signs of a phishing attempt (spoofed domain, urgent request for credentials). The best first action is to report it to the security team so they can block the threat and warn others. Clicking the link could compromise credentials. Deleting the email or ignoring it does not help protect other employees. Replying would confirm the email address is active.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.