Free practice · multiple-choice · hard
Practice
Respond after credentials were entered
A worker entered a password and approved one MFA prompt on a suspicious site. Which actions belong in the immediate response?
Beginner incident handoff
Stop harm, preserve facts, and support authorized recovery
- StopEnd the risky action
- ContainUse only authorized instructions
- ReportShare assets, time, facts, and actions
- PreserveKeep evidence and a factual timeline
- CoordinateSupport scope and business decisions
- RecoverVerify clean service and improve controls
A strong beginner response is prompt and factual without becoming an unauthorized investigation, cleanup, payment, or public-communication effort.