A security analyst receives an alert that a user clicked a link in a phishing email and entered their corporate credentials on a fake login page. Which of the following should the analyst do FIRST to minimize further damage?

Run a full antivirus scan on the user's workstation

Running an antivirus scan is not the first step because the incident is a credential theft via phishing, not a malware infection. While the system may have been compromised, containment of the credentials is more urgent.

Reset the user's password and force re-authentication

Resetting the password is a corrective action but doing so before containing the attacker's access could alert them, allowing them to pivot or destroy evidence. Containment should come first.

Contact law enforcement and report the phishing site

Contacting law enforcement is important but should be done after internal containment and data preservation. Immediate containment takes priority over external reporting.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Disable the user's account and block the compromised system from the network — In incident response, the correct order is identification, containment, eradication, recovery. After confirming a credential compromise, the immediate priority is containment to prevent the attacker from using the stolen credentials to access other systems or data. Resetting the password without first containing could tip off the attacker if they are already active. Running antivirus is irrelevant because the user likely did not download malware. Notifying law enforcement is premature before internal containment and investigation.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.