212-89 Email Incidents — 10 Questions

Question 1

When DKIM signature verification fails, what is the most likely technical cause?

Accepted Answer

The body of the message was modified in transit. DKIM verification fails if the body content or headers were altered after signing.

Answer

The sender's IP address is on a blocklist

Answer

The user clicked a phishing link

Answer

The SPF record is missing

Question 2

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

Accepted Answer

Search and Purge in Microsoft 365 Defender. Search and Purge within the Microsoft 365 Defender portal is the standard tool for post-delivery removal.

Answer

Conditional Access policies

Answer

Exchange Transport Rules

Answer

Mail Flow Connector configuration

Question 3

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Accepted Answer

Run the URL against an automated sandbox analysis tool. Before interaction, you must detonate in a sandbox to ensure safety.

Answer

Click the URL to inspect the landing page

Answer

Block the sender domain immediately

Answer

Forward the email to the user for confirmation

Question 4

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Accepted Answer

The file is a double-extension obfuscation attempt. The double extension is a common technique to trick users into executing a binary file.

Answer

The file is a legitimate script file

Answer

The file is encrypted with a password

Answer

The file is a genuine PDF that requires an executable

Question 5

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC provides the policy instructions for SPF and DKIM failures.

Answer

SMTPS

Answer

IMAP

Answer

POP3

Question 6

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 7

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The Received header is added by every MTA that handles the message, providing a verifiable path.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer

Question 8

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

Accepted Answer

Professional, calm, and informative. The tone should be professional, reassuring, and helpful to encourage future reporting.

Answer

Accusatory, to discourage clicking

Answer

Technical and jargon-heavy

Answer

Alarmist, to ensure they remain scared

Question 9

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Accepted Answer

Oledump. Oledump is the industry standard tool for identifying and extracting macros from Office documents.

Answer

Nmap

Answer

Wireshark

Answer

Volatility

Question 10

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Accepted Answer

Financial loss via unauthorized transfers. BEC targets employees to perform unauthorized financial transfers through social engineering.

Answer

System performance degradation

Answer

Infrastructure downtime

Answer

Spam distribution