A security analyst receives multiple alerts indicating that several users in the finance department clicked a malicious link in an email. The analyst has confirmed the email subject line and sender address. Which of the following is the BEST first step to contain the incident?

Disable the users' accounts.

This is incorrect because disabling accounts is a drastic step that would halt all user activity, including legitimate work, and it does not directly address the email propagation path.

Perform a forensic analysis of the emails.

This is incorrect because forensic analysis is an investigation step that occurs after containment; performing it first would delay stopping the spread of the attack.

Delete the emails from the users' mailboxes.

This is incorrect because deleting emails only removes the messages from already affected mailboxes but does not prevent new malicious emails from arriving; containing the source is more effective.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Block the sender's email address at the email gateway. — In incident response, containment is a critical early phase aimed at preventing the incident from causing further damage. The best first step in this scenario is to block the sender's email address at the email gateway, as this immediately stops additional malicious emails from reaching any users, thus containing the spread. Disabling user accounts is too aggressive for a phishing incident where the primary vector is email and may disrupt legitimate work. Performing forensic analysis or deleting emails are actions that typically occur after containment, not before. Therefore, blocking the sender at the gateway is the most effective and immediate containment measure.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.