212-89 Email Incidents — 20 Questions

Question 1

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Accepted Answer

Run the URL against an automated sandbox analysis tool. Running the URL against an automated sandbox analysis tool is the safest first step because it detonates or inspects the URL in an isolated environment, revealing malicious behavior without exposing the analyst's system or the organization. This aligns with phishing triage best practices of analysis before action. Clicking the URL directly or forwarding to a user risks compromise.

Answer

Click the URL to inspect the landing page

Answer

Block the sender domain immediately

Answer

Forward the email to the user for confirmation

Question 2

An incident responder is examining a suspicious email that contains a link to a credential-harvesting page. The link uses a URL shortener and redirects through multiple domains. Which TWO of the following actions are appropriate for safely analyzing the link? (Choose two.)

Accepted Answer

Use a URL expander service to reveal the final destination without visiting it.. Submitting the URL to a sandbox and using a URL expander are safe methods to analyze a suspicious link without exposing the responder or organization to risk. These techniques reveal the final destination and any malicious behavior in a controlled manner.

Answer

Forward the email to a colleague in the security team and ask them to click the link.

Answer

Open the link in a virtual machine with a standard corporate image to see the page.

Answer

Copy the link and paste it into a browser on the responder's workstation.

Question 3

A user reports receiving an email that appears to come from the CEO asking for an urgent wire transfer. The email passes SPF and DKIM checks. Which two characteristics most strongly indicate this is a business email compromise (BEC) rather than a spoofed message? (Choose two.)

Accepted Answer

The reply-to address differs from the From address and belongs to an external domain.. BEC attacks often use compromised or lookalike accounts that pass SPF and DKIM, so authentication success does not rule out fraud. The reply-to mismatch and recently registered lookalike domain are the strongest indicators because they reveal the attacker's intent to impersonate an executive while controlling responses. Malicious attachments, DMARC failures, and credential-harvesting links point to different email threat categories.

Answer

The message fails DMARC alignment for the displayed From domain.

Answer

The email includes a link to a credential-harvesting page.

Answer

The email contains a malicious macro-enabled attachment.

Question 4

During an email incident, you obtain a suspicious message in .eml format. You need to extract the actual sender IP and verify the message path without altering any evidence. Which action best preserves forensic integrity while giving you the data you need?

Accepted Answer

Open the .eml in a text editor and inspect the Received headers from the bottom of the list upward. Received headers are added in order as the message moves between servers, so the bottom-most entry reflects the earliest hop and the originating IP. Inspecting a copy in a text editor is non-destructive and yields the full header chain, while forwarding or rendering the message rewrites or alters it and risks notifying the attacker.

Answer

Open the .eml in the mail client and use the Print to PDF option to capture the headers

Answer

Open the attachment in a sandbox and read the SMTP envelope fields from the sandbox report

Answer

Forward the .eml to your own mailbox and read the headers in the received copy

Question 5

When DKIM signature verification fails, what is the most likely technical cause?

Accepted Answer

The body of the message was modified in transit. DKIM uses a cryptographic signature over specified headers and the message body. If the body is modified in transit, the hash computed by the receiver will not match the signature, causing verification to fail. This is the most likely technical cause of DKIM failure.

Answer

The sender's IP address is on a blocklist

Answer

The user clicked a phishing link

Answer

The SPF record is missing

Question 6

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

Accepted Answer

Search and Purge in Microsoft 365 Defender. Search and Purge in Microsoft 365 Defender (formerly Office 365 Advanced Threat Protection) allows administrators to search for and delete malicious emails from all user mailboxes. This feature is designed specifically for incident response to remove phishing or malware emails globally, ensuring they cannot be accessed by users. It supports searching by sender, subject, or other criteria and can purge messages from all mailboxes in the organization.

Answer

Conditional Access policies

Answer

Exchange Transport Rules

Answer

Mail Flow Connector configuration

Question 7

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Accepted Answer

The file is a double-extension obfuscation attempt. A filename like 'invoice.pdf.exe' uses a double extension to disguise an executable as a PDF. Windows hides known file extensions by default, so the file may appear as 'invoice.pdf' to the user, but it actually runs as an .exe. This is a classic social-engineering technique to trick users into executing malware.

Answer

The file is a legitimate script file

Answer

The file is encrypted with a password

Answer

The file is a genuine PDF that requires an executable

Question 8

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM by allowing domain owners to publish a policy that instructs receivers on how to handle emails that fail SPF and/or DKIM alignment checks. It also provides reporting mechanisms. SPF authenticates the sending server, DKIM cryptographically signs the message, and DMARC ties them together with a policy.

Answer

SMTPS

Answer

IMAP

Answer

POP3

Question 9

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 10

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The 'Received' header field is added by each mail transfer agent (MTA) as the message passes through it, creating a chronological list of hops. It is the most reliable field for tracing the path an email took, including originating IP and intermediate servers. Analysts read Received headers from bottom to top to follow the actual delivery chain.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer

Question 11

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

Accepted Answer

Professional, calm, and informative. When responding to a user who reported a phishing attempt, the analyst's primary goal is to encourage future reporting and avoid discouraging the user. A professional, calm, and informative tone reassures the user that their action was correct, provides clear guidance without blame, and maintains trust in the security team. This approach aligns with incident response best practices, which emphasize positive reinforcement to foster a security-aware culture. Accusatory, alarmist, or overly technical tones can backfire by making users defensive or confused, reducing the likelihood they will report future incidents.

Answer

Accusatory, to discourage clicking

Answer

Technical and jargon-heavy

Answer

Alarmist, to ensure they remain scared

Question 12

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Accepted Answer

Oledump. Oledump is a specialized tool for analyzing OLE (Object Linking and Embedding) files, including Word documents with VBA macros. It extracts and decompresses macro streams from the document, allowing static analysis of the macro code without executing it. This makes it the best choice for static analysis of a suspicious macro.

Answer

Nmap

Answer

Wireshark

Answer

Volatility

Question 13

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Accepted Answer

Financial loss via unauthorized transfers. BEC targets employees to perform unauthorized financial transfers through social engineering.

Answer

System performance degradation

Answer

Infrastructure downtime

Answer

Spam distribution

Question 14

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Accepted Answer

To prevent re-occurrence of the same campaign. Updating the blocklist after resolving an email incident is a proactive measure to prevent the same malicious campaign from affecting the organization again. By adding the identified malicious sender addresses, domains, or IPs to the blocklist, future emails from the same source are automatically blocked, thus breaking the attack chain. This directly reduces the risk of re-infection or re-compromise from the same threat actor. The other options do not address the primary security objective of incident response.

Answer

To comply with legal regulations

Answer

To improve system performance

Answer

To delete the user's account

Question 15

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Accepted Answer

Inspecting the Punycode representation of the domain. Homograph attacks use visually similar Unicode characters (e.g., Cyrillic 'а' instead of Latin 'a') to spoof legitimate domains. The Punycode representation (the ASCII-compatible encoding prefixed with 'xn--') exposes these non-ASCII characters, allowing analysts to detect the spoof. Inspecting the Punycode is the definitive technical method to unmask a homograph domain.

Answer

Scanning the email for attachments

Answer

Checking the SPF record

Answer

Looking for a valid TLS certificate

Question 16

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

Accepted Answer

Attempt to contain the threat by removing the email. Once a phishing email has bypassed the perimeter gateway, the immediate priority is to prevent further harm by containing the threat. Removing the email from user inboxes (and possibly from the mail server) stops additional users from clicking malicious links or opening attachments, which is the core containment step in incident response. This aligns with the containment phase of the NIST SP 800-61 incident response lifecycle, which follows detection and precedes eradication and recovery.

Answer

Document the incident in the SIEM

Answer

Update the firewall blocklist

Answer

Wait for the user to report it again

Question 17

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

Accepted Answer

Emails are being forwarded to an external address. Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.

Answer

The user's inbox is empty

Answer

The mailbox reached its size limit

Answer

The password was changed

Question 18

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Accepted Answer

It prevents security gateways from scanning the contents. Password-protected compressed archives (e.g., ZIP, RAR, 7z) cannot be inspected by email security gateways because the contents are encrypted. Attackers use this to smuggle malware past antivirus and sandbox scanning, since the gateway cannot decrypt the archive without the password, which is typically provided in the email body.

Answer

It requires too much storage space

Answer

It is a sign of high security

Answer

It violates corporate policy

Question 19

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Accepted Answer

The SPF record is too broad. SPF authorizes sending IPs via DNS TXT records. If the record uses an overly broad mechanism such as 'include' of a large third-party range, '+all', or a wide CIDR, an unauthorized IP inside that range will still pass SPF. The most likely cause is therefore an SPF record that is too permissive, allowing the spoofed source to authenticate.

Answer

The user's computer is infected

Answer

The domain has no DMARC record

Answer

The mail server was misconfigured

Question 20

What is the purpose of 'Sandboxing' in email security?

Accepted Answer

To safely execute and observe file behavior. Sandboxing in email security involves detonating suspicious attachments or URLs in an isolated, instrumented environment to observe their runtime behavior—such as file system changes, network callbacks, or process injections—without risking the production network. This dynamic analysis catches zero-day malware and evasive threats that static signatures miss, because the sandbox watches what the code actually does rather than what it looks like. The option 'safely execute and observe file behavior' precisely captures this controlled detonation and behavioral monitoring purpose.

Answer

To provide a backup of the email

Answer

To store malicious emails for future reference

Answer

To encrypt the email body