Ravi Sir's Cyber Security Cards › Interview Cards
Walk through how you triage a phishing alert.
Walk through how you triage a phishing alert. Check the email headers and SPF/DKIM/DMARC , the URL/attachment reputation, and whether the user clicked. If they clicked, check proxy/DNS/EDR for what happened next, and isolate only if evidence supports it. “Headers and auth first, then click evidence,
Read card text
What this card says
Short answer
Check the email headers and SPF/DKIM/DMARC, the URL/attachment reputation, and whether the user clicked.
Example
If they clicked, check proxy/DNS/EDR for what happened next, and isolate only if evidence supports it.
Say it in the interview
“Headers and auth first, then click evidence, then contain if needed, and I notify the user.”
Why it matters
A clear order stops you isolating a machine for nothing or missing a real click.
Learn more in the lesson: 47.4 SOC Analyst Round – SIEM, Triage, MITRE