Your question is Handling an Internal Phishing Attack. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Tell me about how you would manage a phishing attack within an organization.
Explain how you would detect, triage, contain, eradicate, and recover from the attack. Address compromised credentials, malicious email delivery, endpoint involvement, user communications, evidence preservation, and the controls you would implement afterward. Name the signals, technologies, decision points, and verification steps you would use.