SOC wants alerts when phishing messages are removed after delivery (ZAP-style events) at high volume. What configures notifications?
Select an answer to reveal the explanation.
Short Explanation and Infographic
When ZAP cleans phish after delivery, you still want the smoke alarm. Alert policies notify SOC of volume spikes.
Full explanation below image
Full Explanation
Correct Answer — A
Alert policies can notify admins about threat events including post-delivery removals and related campaign signals.
Why B is wrong: Branding cosmetic.
Why C is wrong: Excel theme.
Why D is wrong: Slide size.
Exam tip: Notify on post-delivery phish removal → alert policies.