312-39V2: Certified SOC Analyst v2

Question

A security operations center (SOC) team is investigating a phishing attack aimed at multiple employees. During the Containment Phase, the team must establish how users interacted with the malicious email—whether they opened it, clicked links, downloaded attachments, or entered credentials. This information is essential for assessing impact and preventing additional compromise. Which specific activity enables the SOC team to understand user interactions with the phishing email?

Explanation

User action verification establishes which recipients opened the phishing message, followed malicious links, downloaded attachments, or submitted credentials. Those facts identify the affected users and determine the attack’s scope and potential compromise.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ76

Community Discussion