Problem Statement
A user reports a suspicious email asking for login details. What should be your first action?
Explanation
The first step is analysis — not deletion.
Security teams must examine headers, links, and attachments to extract indicators such as malicious domains or IPs before containment or reporting actions.