Quick Answer

The answer is emails with similar subject lines being sent from internal accounts, unusual outbound network connections from user workstations, and new scheduled tasks created on endpoints without user knowledge. These three indicators of compromise (IOCs) are most relevant after a successful phishing attack because they directly reflect the attacker’s post-exploitation behavior: credential theft enables lateral phishing via compromised internal accounts, while outbound connections to unexpected IPs signal command-and-control (C2) communication or data exfiltration, and unauthorized scheduled tasks reveal persistence mechanisms like schtasks.exe used to maintain access. On the CompTIA CySA+ CS0-003 exam, this question tests your ability to prioritize IOCs that indicate active compromise rather than initial delivery—a common trap is focusing on the phishing email itself (e.g., malicious attachments or links) instead of the attacker’s actions after credentials are stolen. Remember the memory tip: “Phish leads to fish—after the hook, watch for outbound flows, new tasks, and internal blasts.”