Certified Incident Handler (CIH) Practice Ecam

What action should be taken to eradicate email security incidents effectively?

1. Notify affected users without further action

2. Block and remove impacted accounts

3. Ignore reports from users

4. Leave the accounts open for monitoring

The correct answer is: Block and remove impacted accounts

To effectively eradicate email security incidents, the appropriate action is to block and remove impacted accounts. This approach serves to immediately mitigate the risk posed by compromised accounts, preventing further unauthorized access or potential data breaches. When an account is determined to have been compromised, leaving it active could allow attackers to continue exploiting it, thereby prolonging the security incident and causing additional harm. Blocking the account immediately cuts off any ongoing malicious activities that may be occurring from that account, such as sending phishing emails or leaking sensitive information. Following this, a thorough investigation can be conducted to assess the extent of the breach, recover from the incident, and strengthen security measures to prevent similar occurrences in the future. Other actions, such as merely notifying affected users without further action, do not address the root of the problem and can leave organizations vulnerable to continued threats. Ignoring reports from users fails to take proactive steps against potential incidents, while leaving accounts open for monitoring may expose the organization to unintended consequences. Thus, proactively blocking and removing the impacted accounts is essential in effectively addressing email security incidents.