212-89 Email Incidents — 20 Questions

Question 1

When DKIM signature verification fails, what is the most likely technical cause?

Accepted Answer

The body of the message was modified in transit. DKIM verification fails if the body content or headers were altered after signing.

Answer

The sender's IP address is on a blocklist

Answer

The user clicked a phishing link

Answer

The SPF record is missing

Question 2

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

Accepted Answer

Search and Purge in Microsoft 365 Defender. Search and Purge within the Microsoft 365 Defender portal is the standard tool for post-delivery removal.

Answer

Conditional Access policies

Answer

Exchange Transport Rules

Answer

Mail Flow Connector configuration

Question 3

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Accepted Answer

Run the URL against an automated sandbox analysis tool. Before interaction, you must detonate in a sandbox to ensure safety.

Answer

Click the URL to inspect the landing page

Answer

Block the sender domain immediately

Answer

Forward the email to the user for confirmation

Question 4

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Accepted Answer

The file is a double-extension obfuscation attempt. The double extension is a common technique to trick users into executing a binary file.

Answer

The file is a legitimate script file

Answer

The file is encrypted with a password

Answer

The file is a genuine PDF that requires an executable

Question 5

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC provides the policy instructions for SPF and DKIM failures.

Answer

SMTPS

Answer

IMAP

Answer

POP3

Question 6

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 7

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The Received header is added by every MTA that handles the message, providing a verifiable path.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer

Question 8

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

Accepted Answer

Professional, calm, and informative. The tone should be professional, reassuring, and helpful to encourage future reporting.

Answer

Accusatory, to discourage clicking

Answer

Technical and jargon-heavy

Answer

Alarmist, to ensure they remain scared

Question 9

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Accepted Answer

Oledump. Oledump is the industry standard tool for identifying and extracting macros from Office documents.

Answer

Nmap

Answer

Wireshark

Answer

Volatility

Question 10

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Accepted Answer

Financial loss via unauthorized transfers. BEC targets employees to perform unauthorized financial transfers through social engineering.

Answer

System performance degradation

Answer

Infrastructure downtime

Answer

Spam distribution

Question 11

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Accepted Answer

To prevent re-occurrence of the same campaign. Updating the blocklist prevents future delivery of emails from the same source or with the same malicious artifacts.

Answer

To comply with legal regulations

Answer

To improve system performance

Answer

To delete the user's account

Question 12

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Accepted Answer

Inspecting the Punycode representation of the domain. Homograph attacks use look-alike characters (like Cyrillic 'а' instead of Latin 'a') that are visible when inspecting the Punycode version of the domain.

Answer

Scanning the email for attachments

Answer

Checking the SPF record

Answer

Looking for a valid TLS certificate

Question 13

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

Accepted Answer

Attempt to contain the threat by removing the email. After detection, containment is the critical priority to prevent further impact.

Answer

Document the incident in the SIEM

Answer

Update the firewall blocklist

Answer

Wait for the user to report it again

Question 14

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

Accepted Answer

Emails are being forwarded to an external address. Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.

Answer

The user's inbox is empty

Answer

The mailbox reached its size limit

Answer

The password was changed

Question 15

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Accepted Answer

It prevents security gateways from scanning the contents. Password protection hides the file contents from automated antivirus scanners.

Answer

It requires too much storage space

Answer

It is a sign of high security

Answer

It violates corporate policy

Question 16

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Accepted Answer

The SPF record is too broad. If SPF passes but the IP is wrong, it is likely the attacker is using an email service that is part of the same SPF-authorized infrastructure (like a shared cloud provider).

Answer

The user's computer is infected

Answer

The domain has no DMARC record

Answer

The mail server was misconfigured

Question 17

What is the purpose of 'Sandboxing' in email security?

Accepted Answer

To safely execute and observe file behavior. Sandboxing executes a file in a controlled, virtual environment to observe its behavior before allowing it to reach the end user.

Answer

To provide a backup of the email

Answer

To store malicious emails for future reference

Answer

To encrypt the email body

Question 18

Which THREE of the following are common indicators of a phishing email?

Accepted Answer

Urgent or threatening language requiring immediate action. Suspicious sender domains, mismatched URLs, and sense of urgency are primary phishing indicators.

Answer

The email uses standard corporate branding

Answer

The email is sent during business hours

Question 19

Which action should be taken after an email incident is contained and the indicators are identified?

Accepted Answer

Update security controls and user awareness programs. Post-incident activities include updating policies and procedures to prevent recurrence.

Answer

Ignore the event to focus on the next

Answer

Decommission the email server

Answer

Immediately delete all logs

Question 20

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

Accepted Answer

The email was scanned by Microsoft's filtering engine. This header provides information on how Microsoft's filtering engine analyzed the message, including spam confidence levels.

Answer

The email is definitely malicious

Answer

The sender is a known spammer

Answer

The email is encrypted