What Should Be Done First After PII Is Emailed to a Personal Account?

CS0-003 By islever Editorial Last updated

Given a scenario, perform incident response activities Explain the importance of incident response reporting and communication

Short answer

A Place a legal hold on the employee’s mailbox to preserve the PII-related email evidence before applying CASB containment.

Question

During an incident, a security analyst discovers a large amount of PII has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee’s personal email. Which of the following should the analyst recommend be done first?
  1. Place a legal hold on the employee’s mailbox. Correct Answer
  2. Enable filtering on the web proxy.
  3. Disable the public email access with CASB.
  4. Configure a deny rule on the firewall.

Key Takeaways

The question tests incident-response sequencing for insider data exfiltration; the trap is treating CASB containment as automatically first even though it does not recover or protect the already-sent evidence.

This CySA+ scenario tests incident-response ordering when an employee has sent PII to a personal webmail account. It establishes that the analyst should recommend a legal hold first to preserve the corporate mailbox and sent-item evidence before containment.

Common mistake: The common mistake is selecting CASB blocking (C) because it sounds like immediate containment, without recognizing that a legal hold must preserve the employee's mailbox and sent-item evidence before any action that could prompt deletion.

Expert Analysis

Why the Answer Is Correct

A legal hold is the evidence-preservation action that prevents the employee—or routine retention policies—from deleting or altering the corporate mailbox and sent items. Because the PII has already left for a personal account the organization does not control, the recoverable evidence is the internal mailbox, mail logs, and associated records. The analyst is not necessarily executing the hold, but the question asks what to recommend first, so recommending that legal/compliance issue the hold is appropriate. This also avoids tipping off the employee before evidence is secured.

Why the Other Options Are Wrong

C is the strongest distractor: disabling public email access through CASB is containment, but it cannot recall the already-sent PII and is not the first evidence step. B and D are broad network controls that may reduce future webmail use but do not preserve the mailbox and cannot reliably block every personal email route. D in particular is a firewall deny rule, which is coarse and unlikely to target the specific internal evidence. None of B, C, or D secures the sent-item evidence before it can be deleted.

Community Comment Notes

Jay2021aws argued that legal holds belong to legal/compliance and that the analyst should focus on containment, but the question asks what the analyst should recommend, not execute. Pochex drew the key distinction that C is "a containment step, not the first step," while huffery noted the personal account is "outside the organization’s direct control." 39a1535 and edykemboi favored C for immediate containment, which reflects the main disagreement on the page. Yatoro and JayWeston supported A as quick evidence preservation.

Official Reference

https://csrc.nist.gov/pubs/sp/800/61/r2/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question says "first" after PII leaves the organization, separate evidence preservation from containment. Choose the legal hold before broad blocking controls unless the question explicitly asks how to stop ongoing exfiltration.

Frequently Asked Questions

Why not disable public email access with CASB first?

CASB blocking is containment, but it cannot recall the already-sent PII and may prompt the employee to delete evidence; the mailbox legal hold must come first.

Can a security analyst place a legal hold without legal approval?

Usually no; legal or compliance executes the hold, but the analyst should immediately recommend it so mailbox retention and evidence preservation begin.

More CS0-003 FAQ →

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Jay2021aws 👍 15
    recommending to place a legal hold on the employee's mailbox should be handled by legal or compliance departments rather than a security analyst. The security analyst's role would be more focused on identifying and containing the breach, gathering evidence, and analyzing the impact. Given the options, a more appropriate initial step would be to disable the public email access with CASB (Option C), as it would immediately prevent further data exfiltration and control the situation. This action helps to contain the breach and limit the exposure of sensitive data.
  2. 39a1535 👍 6 Answered C
    C. This step helps contain the breach by immediately stopping further unauthorized transfers of PII to external email addresses.
  3. Yatoro 👍 4 Answered A
    A. Place a legal hold on the employee’s mailbox 🧠 Key Situation PII was emailed externally To employee’s personal email 👉 Possible: Insider threat / data exfiltration 🔑 What should be done FIRST? Preserve evidence
  4. Only12go 👍 4 Answered A
    ✔️ Proper Sequence: Escalate to Legal Place a legal hold on the user’s mailbox and any other relevant data Contain the threat with CASB, IAM, or other security tools Begin full investigation and incident response
  5. huffery 👍 3 Answered A
    The employee’s personal email (public email) is outside the organization’s direct control — often on third-party services like Gmail, Yahoo, Outlook.com, etc. Because of this, blocking or disabling their access (like with CASB or firewall rules) is usually not possible or effective for their personal accounts. Instead, the organization’s best lever is to preserve evidence internally first — which means placing a legal hold on the employee’s work mailbox or other organizational assets related to the incident. Later, you might involve legal or law enforcement to pursue access or remedies regarding the personal account.
Show 8 more comments
  1. JayWeston 👍 2 Answered A
    I would start by putting a legal hold on the email as we know a breach was made that involved PII. This step is quick, easy, and it will have to be done at some point. Using CASB to disable access to a service has a lot of implications that really needs to be thought through to figure out the business impact. Do we know for sure that there was no business need as to why the external email site was open in the first place? Plus is it really going to help against what seems like a malicious insider threat? They are going to use drop box or a USB drive.
  2. edykemboi 👍 2 Answered C
    Immediate containment is critical. Since sensitive PII has already been exfiltrated to a personal email, the priority is to stop any further data leakage. CASB (Cloud Access Security Broker) can enforce controls on cloud services, including blocking or restricting access to personal/public email accounts (like Gmail, Yahoo, etc.) from corporate systems. This directly prevents the employee from continuing to send sensitive data externally.
  3. Kakster 👍 2
    I'd go with A, because even though the analyst doesn't physically place a legal hold, they initiate it by escalating to the correct authority. This preserves evidence. Disabling public email access will warn the employee, and possibly cause loss of evidence.
  4. Pochex 👍 2 Answered A
    A legal hold ensures that emails and related data cannot be altered or deleted, preserving the evidence for investigation, this must be the first step. Option C is a containment step, not the first step.
  5. robizman 👍 2
    Does the SA have permission to place this legal hold? This is handled by legal or compliance team. Leaving C the best option for the SA
  6. Paradox_Walnut 👍 2 Answered C
    Didn't pick "C" due to CompTIA not mentioning anything regarding "Cloud", so I ignored the CASB option. Good on ya CompTIA.
  7. rocco82 👍 1 Answered A
    C. Cannot be done easily, its a personal email address probably google or outlook. A. Legal hold prevents evidence destroyed A
  8. Kakster 👍 1
    And what about the PII that has already been transferred? Option A places a freeze on it and preserves it.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide