CompTIA Security+ SY0-701 Practice Question

The best action is to verify the identity of the caller through a callback to a known, official phone number for the telecommunications provider before discussing sensitive information. This is because providing such details over the phone without verification can lead to potential security breaches. Unverified calls, especially those requesting sensitive information, are likely to be vishing attacks where attackers attempt to extract critical information by impersonating legitimate entities. Unlike the incorrect options, immediate verification is critical and proper protocol in such situations; informing a supervisor is also advisable but does not directly address the potential immediate threat. Sharing the requested information or placing the caller on a brief hold without attempting to verify their identity doesn't reduce the risk associated with the potential vishing attempt.