CompTIA Security+ Education & Occupational Skills Learning Path • Module 2

Threat Recognition and User Response

Apply responding safely to phishing, suspicious prompts, and social engineering through approved procedures, objective verification, documentation, and escalation.

22 minutes80% mastery targetPractice—unlimited attempts

Enter your participant information to start activity tracking.

Learning outcomes

Explain the purpose of responding safely to phishing, suspicious prompts, and social engineering.
Apply approved procedures to a realistic CompTIA Security+ situation.
Verify results, document objective evidence, and escalate conditions outside authorized scope.

Apply the approved workflow

Do not interact with suspicious links, attachments, or login prompts. Report the event promptly through the approved channel. Reliable performance begins with correct identification, current instructions, safe conditions, and a clear understanding of authority.

Key points

Do not interact with suspicious links, attachments, or login prompts.
Report the event promptly through the approved channel.
Confirm scope and prerequisites before acting.

Verify, document, and communicate

Preserve useful details without forwarding harmful content unnecessarily. A task is not complete until the result is checked against the expected outcome and the record allows another authorized person to understand what occurred.

Key points

Preserve useful details without forwarding harmful content unnecessarily.
Record objective facts, actions, results, and unresolved risks.
Escalate exceptions promptly through the authorized channel.

Applied scenario

Threat Recognition and User Response: verify before proceeding

During a security operations task involving a protected organizational asset, a CompTIA Security+ practitioner is completing the Threat Recognition and User Response module scenario. An identifier, instruction, measurement, or expected result does not agree with the available record. The task has a deadline, but proceeding without resolving the conflict could create safety, privacy, quality, compliance, or service risk. Decide how the task should continue and what evidence must be recorded.

Practice check

Apply what you learned

Answer all five questions. Feedback will identify what to review before you try again.

1Which action best supports responding safely to phishing, suspicious prompts, and social engineering? Restore service before confirming containment and required security validation Use one preventive control as a substitute for layered protection and monitoring Do not interact with suspicious links, attachments, or login prompts. Forward harmful content widely so coworkers can recognize it

2Within Threat Recognition and User Response, what should happen before the participant proceeds? Keep privileged access after the role or business need has ended Change incident timestamps to make the response sequence appear complete Collect and retain sensitive data that is not needed for an authorized purpose Report the event promptly through the approved channel.

3For responding safely to phishing, suspicious prompts, and social engineering, which closeout action provides the strongest evidence of reliable performance? Preserve useful details without forwarding harmful content unnecessarily. Treat a control as effective without testing or monitoring its operation Grant broad permanent access because the immediate request appears legitimate Open a suspicious link to determine whether the message is malicious

4During Threat Recognition and User Response, what is the best response when the result conflicts with expectations? Delete logs and files before the incident record and evidence are preserved Pause the task involving Threat Recognition and User Response, reconcile the evidence and requirements, and obtain authorized guidance before proceeding Share an encryption key through the same channel as the protected data Accept a vulnerability without recording the owner, rationale, or residual risk

5After work involving responding safely to phishing, suspicious prompts, and social engineering, what should the complete task record communicate? Restore service before confirming containment and required security validation Use one preventive control as a substitute for layered protection and monitoring Record the facts for Threat Recognition and User Response, authorized actions, verification results, unresolved risks, and next responsible owner Forward harmful content widely so coworkers can recognize it

Reflection and workplace transferDescribe how you would apply verification and documentation during a CompTIA Security+ task involving responding safely to phishing, suspicious prompts, and social engineering.

← Return to CompTIA Security+ Education & Occupational Skills Learning Path