An incident responder is examining a suspicious email that contains a link to a credential-harvesting page. The link uses a URL shortener and redirects through multiple domains. Which TWO of the following actions are appropriate for safely analyzing the link? (Choose two.)
A user reports receiving an email that appears to come from the CEO asking for an urgent wire transfer. The email passes SPF and DKIM checks. Which two characteristics most strongly indicate this is a business email compromise (BEC) rather than a spoofed message? (Choose two.)
During an email incident, you obtain a suspicious message in .eml format. You need to extract the actual sender IP and verify the message path without altering any evidence. Which action best preserves forensic integrity while giving you the data you need?
An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?
An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?
A user reports an email that appears to come from the CFO but the message was sent from an external IP address. The message passed SPF but failed DMARC alignment. What should the incident handler do first?
An attacker compromises a user's Microsoft 365 mailbox and creates an inbox rule that moves all messages from the CFO to the 'RSS Feeds' folder and marks them as read. The user never sees these messages. Which type of email incident does this behavior most directly represent?
An attacker compromises a user's Microsoft 365 mailbox and creates a hidden inbox rule that moves any message containing 'wire transfer' to the RSS Feeds folder and marks it as read. The security team must determine which native artifact best proves the rule existed even after the attacker deletes it from Outlook on the web. What should the team review?
An incident responder is examining a suspected business email compromise (BEC) message. The message passed SPF, DKIM, and DMARC alignment checks. The From display name is the CEO's name, but the actual envelope sender is a lookalike domain registered two days ago. Which characteristic of this message most directly explains why the authentication checks succeeded while the message is still malicious?
A user reports an email from a known vendor that asks them to confirm banking details by replying with a completed form attached as an HTML file. The message passed SPF, DKIM, and DMARC because it came from the vendor's legitimate mail server. As the incident handler, what is the most accurate conclusion about this email?
A user reports receiving an email with a .zip attachment that is password-protected and the password is included in the email body. The email claims to be an invoice from a known vendor. What is the most likely reason for this?
A user reports an email claiming to be from the IT helpdesk that asks them to click a link and re-enter their credentials because their mailbox is full. The user has not clicked the link. According to the Certified Incident Handler process, what is the most appropriate immediate action?
An incident handler is investigating a suspected email compromise and discovers a new inbox rule that automatically moves messages containing specific keywords to the Deleted Items folder. What is the most likely purpose of this rule?
An analyst is investigating an email incident where several users received messages with a link to a legitimate file-sharing service. The link points to a document hosted on that service, and the document contains a macro that downloads a payload. The email gateway did not block the message because the link domain is reputable. Which technique is the attacker most likely using to evade email security controls?
During an email incident investigation, you need to determine whether a message was altered in transit. You have the full email headers. Which header field should you examine to verify the cryptographic signature that validates the message content and ensures it was not modified after sending?
During an email incident investigation, an analyst needs to determine the originating IP address of a message that passed through multiple mail servers. The message headers contain several 'Received' fields. Which action should the analyst take to identify the true origin?
During an email incident investigation, you need to analyze a malicious macro embedded in a Word document without executing it. Which tool is most appropriate for extracting and examining the macro code?
A user reports that they received an email from 'IT Support' asking them to click a link to reset their password. The link goes to a domain that looks similar to the company's but has a different top-level domain. The user did not click the link. What is the FIRST action the incident handler should take?
An employee receives a message that appears to come from the CEO asking for an urgent gift card purchase, and the reply-to address is a free webmail account. The employee reports it without clicking anything. Which containment action is most appropriate at this stage?
An organization is responding to an email incident where a user's mailbox is suspected to be compromised and used to send internal phishing emails. Which two actions should the incident handler take to contain the compromise and prevent further spread? (Choose two.)
An incident responder is investigating a suspected email-borne malware incident. The email contained a link that downloaded a file. The responder needs to determine the file's reputation and whether it has been seen in other campaigns. Which action should the responder take?
You are handling a confirmed email incident involving a malicious attachment that executed on several endpoints. Which TWO actions should you take to scope the incident and prevent further execution across the organization? (Choose two.)
An incident handler is reviewing a suspicious email reported by a finance employee. The message appears to come from a known vendor, requests an urgent wire transfer, and contains a PDF attachment. The handler wants to determine whether the sender's domain was authorized to send on behalf of the vendor. Which email authentication result should the handler check FIRST to make this determination?
During an email incident investigation, an analyst extracts a suspicious macro-enabled document from a reported message. The document contains obfuscated VBA code that downloads a payload from a remote host. The analyst wants to safely determine the payload's network behavior without allowing execution on a production workstation. Which approach BEST supports this goal?
A helpdesk technician receives a call from an employee who says they opened an email attachment that appeared to be an invoice, and now their computer is showing a message demanding payment to unlock files. The employee's documents are encrypted and have a new file extension. The technician escalates to the incident response team. Which classification BEST describes this incident?
An incident handler is analyzing a reported email that appears to come from a trusted partner. The message passed SPF and DKIM for the partner's domain, but the handler notices the display name matches the partner while the actual From address uses a look-alike domain with a single character difference. The message also contains a link to a document-sharing site. Which conclusion is MOST accurate?