An employee receives an email from a “trusted” person containing a hyperlink that is malvertising. The employee clicks the link and the malware…

The root cause analysis in incident response focuses on identifying the initial trigger or root cause of

the incident to understand how it started and how to prevent recurrence. In this scenario, the

phishing email sent to the victim (A) is the initial trigger that led to the employee’s action of clicking

the malvertising link, resulting in the malware download.

The other options represent later stages in the incident response cycle, such as detection (SIEM alert,

cybersecurity team’s alert) or supporting evidence (email header information), but they do not

address the root cause, which is the phishing email itself.

This aligns with the CyberOps Technologies (CBRFIR) 300-215 study guide, which states that

identifying the initial vector of compromise is critical to the root cause analysis phase of incident

response (Chapter: Incident Response Techniques, page 410-412).

Reference: CyberOps Technologies (CBRFIR) 300-215 study guide, Chapter: Incident Response

Techniques, Root Cause Analysis, page 410-412.