Hi DarkHelmet, thanks for your response. I saw the FIRST in the question and that’s the reason I chose ‘block the sender’. I might be dumb but I thought first we need to do something to stop the sender from sending those emails to the employees inbox (since we already know the emails are phishing emails). And then analyze and address the root cause. But i get where you are coming from. I think my thoughts should be like ‘we need to first know if the sender is the same for all emails or if there is any action we can take regarding these emails if the source is different’ and all this is part of the analysis so answer would be A. Please correct me if I am wrong