A technician receives an email that appears to come from the company's HR department, stating that all employees must update their direct deposit information immediately by clicking a link and authenticating with their corporate credentials. The sender's email address is 'hr@cornpany.com' (note the 'rn' instead of 'm'). The technician suspects a phishing attack. What should the technician do FIRST?

Delete the email immediately

Deleting the email removes it from the technician's inbox but does not alert the security team. Other employees may still receive and fall victim to the same phishing attempt.

Click the link but do not enter any credentials

Clicking the link could still trigger a malware download or confirm the email address as active, even without entering credentials. This is risky and not recommended.

Reply to the email asking for verification

Replying to a phishing email engages with the attacker and may lead to further social engineering attempts. It also confirms the email address is valid, increasing the likelihood of future attacks.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Forward the email to the company's security team — When an employee suspects a phishing email, the first action should be to report it to the appropriate security team or help desk. Forwarding the email to the security team allows them to analyze the phishing attempt, block the malicious link, and alert other employees. Deleting the email without reporting removes the evidence and does not help protect others. Clicking the link or replying to the sender could compromise the technician's own account or expose them to malware. The correct first step is to report the incident to the security team so they can take action.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.