Employees use the report-phish button, but tickets often sit untouched for days. What awareness-related operational fix is most important?
Select an answer to reveal the explanation.
Short Explanation
If the fire alarm goes to voicemail for three days, people stop pulling it. Reported phish need a real SOC/help-desk pit crew, fast.
Full Explanation
When employees use the report-phish button but tickets sit untouched for days, the awareness program’s human sensor fails operationally. The most important fix is establishing a clear SOC or help-desk response path so reported suspicious messages receive timely triage, containment, and feedback to reporters. Fast response reinforces reporting culture and reduces dwell time for real phishing that reaches municipal inboxes.
Removing the report button to decrease volume silences detection and teaches staff that leadership does not value their alerts. Auto-deleting all reported messages without triage risks destroying evidence and missing true positives that need investigation. Telling staff reporting is symbolic and no response should be expected trains people to stop reporting—the opposite of resilience for city email systems.
Exam caveat: Awareness plus reporting only works with an operational response path; SY0-701 links user reporting to SOC or help-desk handling with timely action.
Operational check: define SLA timers for phish reports, automate ticket creation from the button, staff after-hours coverage or on-call, send acknowledgement and closure notes to reporters, and escalate recurring campaigns to block lists and leadership briefs.