Certified Incident Handler (CIH) Practice Ecam

What is an indicator of a potential phishing attempt in an organization?

1. Multiple complaints about suspicious email

2. Increased user login activity

3. Software updates installed successfully

4. Positive feedback from employees

The correct answer is: Multiple complaints about suspicious email

An indicator of a potential phishing attempt within an organization includes multiple complaints about suspicious emails. When numerous employees report receiving emails that seem unusual or untrustworthy, it raises a red flag that may point to a coordinated phishing attack. Phishing attempts often involve deceptive messages that impersonate legitimate entities to trick users into revealing sensitive information or installing malicious software. The accumulation of complaints serves as a vital signal for the incident response team to investigate further, as it indicates that users are encountering potentially malicious content in their inboxes. Monitoring such feedback is crucial for identifying and mitigating threats early, thereby protecting the organization from possible security breaches. In contrast, increased user login activity does not necessarily indicate phishing; it might simply reflect normal business operations or legitimate security practices. Successful software updates generally indicate that cybersecurity measures are being maintained rather than highlighting a risk. Positive feedback from employees suggests satisfaction with their experience rather than signaling any security concern. This contextual difference reinforces why multiple complaints about suspicious emails are a clear indicator of a potential phishing attempt.