In this simulation, you will step into a high-stakes phishing investigation. You will learn how to transition from detecting an email threat to accurately scoping the user impact to drive precise containment strategies.
You are a Senior SOC Analyst at Nexus Healthcare Logistics. The L1 team escalated a phishing ticket. A highly convincing, spoofed email titled "URGENT: Q3 Benefit Update" bypassed the Secure Email Gateway (SEG). A user reported it via the Phish Alarm button, but your initial message trace shows the email was successfully delivered to 50 mailboxes before the automated purge triggered.
Before you start resetting 50 passwords and isolating workstations, you need to execute precise containment. You pivot from the SIEM to your Web Proxy, EDR, and Identity logs to reconstruct the timeline.
You correlate the email indicators of compromise (IOCs) across multiple telemetry sources to understand the blast radius.
A security operations center (SOC) team is investigating a phishing attack that targeted multiple employees. During the Containment Phase, they need to determine how users interacted with the malicious email, whether they opened it, clicked on links, downloaded attachments, or entered credentials. This information is critical to assessing the impact and preventing further compromise. Which specific activity helps the SOC team understand user interactions with the phishing email?
What is happening here?
The SOC is performing incident scoping during the Containment phase. Just because an email was delivered doesn't mean a breach occurred. By checking proxy logs and Azure AD sign-in logs, the analyst is verifying what the user actually did. In our scenario logs, we see `jsmith` didn't just receive the email—they clicked the link (Zscaler log), didn't download malware (CrowdStrike log), but likely submitted credentials which the attacker then successfully used from a VPS IP (Azure AD log).
Why Option B (User action verification) is Correct:
"User action verification" is the formal process of tracking the human element of an attack chain. Phishing investigations require a matrix of verification: Did they receive it? Did they read it? Did they click the link? Did they enter credentials? Did they run the attachment? Verifying these specific user actions dictates the exact containment response (e.g., forcing a password reset vs. just deleting the email).
Why the other options are incorrect:
When tracking a mass phishing campaign, senior analysts build a mental (or physical) matrix to avoid containing the wrong assets. Treat every recipient differently based on verifiable telemetry:
Without comprehensive user action verification, you risk alert fatigue by isolating 50 hosts when only one user actually clicked the link.
Ready to validate your SOC analytical skills further?
Explore more CSA simulations at ExamRange >>