easyMultiple ChoiceObjective-mapped
FC0-U71 Practice Question: An employee receives an email from an unknown…
An employee receives an email from an unknown sender that includes an attachment labeled 'Invoice.pdf'. The employee does not recall ordering anything. What is the most secure action for the employee to take?
⚠ Common exam trap
A common mix-up: candidates think deleting the email is sufficient (Option D), but the exam emphasizes the importance of reporting security incidents to IT for organizational defense, not just individual action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Forward the email to the IT security team and then delete it.
The most secure action when receiving an unsolicited email with an attachment from an unknown sender is to forward it to the IT security team for analysis and then delete it. This prevents potential malware execution (e.g., macro-based payloads in PDFs) and allows the security team to investigate the threat, such as checking for phishing indicators or malicious scripts. Opening or replying could compromise the system or reveal user information, while simply deleting may miss the opportunity to alert others.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Open the attachment to check if it is a legitimate invoice.
Why it's wrong here
Opening unknown attachments can install malware.
- ✗
Reply to the sender requesting more information.
Why it's wrong here
Replying may confirm the email address to attackers.
- ✓
Forward the email to the IT security team and then delete it.
Why this is correct
Reporting suspicious emails to IT helps protect the organization.
- ✗
Delete the email without opening any attachments.
Why it's wrong here
Deleting without reporting does not alert others to a potential threat.
Go deeper
Related to this question
About these practice questions
This FC0-U71 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This FC0-U71 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the FC0-U71 exam.