212-89 Email Incidents Practice Test 2 — 15 Questions

Question 1

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

Accepted Answer

Attempt to contain the threat by removing the email. Once a phishing email has bypassed the perimeter gateway, the immediate priority is to prevent further harm by containing the threat. Removing the email from user inboxes (and possibly from the mail server) stops additional users from clicking malicious links or opening attachments, which is the core containment step in incident response. This aligns with the containment phase of the NIST SP 800-61 incident response lifecycle, which follows detection and precedes eradication and recovery.

Answer

Document the incident in the SIEM

Answer

Update the firewall blocklist

Answer

Wait for the user to report it again

Question 2

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

Accepted Answer

Emails are being forwarded to an external address. Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.

Answer

The user's inbox is empty

Answer

The mailbox reached its size limit

Answer

The password was changed

Question 3

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Accepted Answer

It prevents security gateways from scanning the contents. Password-protected compressed archives (e.g., ZIP, RAR, 7z) cannot be inspected by email security gateways because the contents are encrypted. Attackers use this to smuggle malware past antivirus and sandbox scanning, since the gateway cannot decrypt the archive without the password, which is typically provided in the email body.

Answer

It requires too much storage space

Answer

It is a sign of high security

Answer

It violates corporate policy

Question 4

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Accepted Answer

The SPF record is too broad. SPF authorizes sending IPs via DNS TXT records. If the record uses an overly broad mechanism such as 'include' of a large third-party range, '+all', or a wide CIDR, an unauthorized IP inside that range will still pass SPF. The most likely cause is therefore an SPF record that is too permissive, allowing the spoofed source to authenticate.

Answer

The user's computer is infected

Answer

The domain has no DMARC record

Answer

The mail server was misconfigured

Question 5

What is the purpose of 'Sandboxing' in email security?

Accepted Answer

To safely execute and observe file behavior. Sandboxing in email security involves detonating suspicious attachments or URLs in an isolated, instrumented environment to observe their runtime behavior—such as file system changes, network callbacks, or process injections—without risking the production network. This dynamic analysis catches zero-day malware and evasive threats that static signatures miss, because the sandbox watches what the code actually does rather than what it looks like. The option 'safely execute and observe file behavior' precisely captures this controlled detonation and behavioral monitoring purpose.

Answer

To provide a backup of the email

Answer

To store malicious emails for future reference

Answer

To encrypt the email body

Question 6

Which THREE of the following are common indicators of a phishing email?

Accepted Answer

Urgent or threatening language requiring immediate action. Option A is correct because phishing emails frequently use urgent or threatening language, such as warnings of account suspension or legal action, to pressure recipients into acting quickly without verifying the message. Option B is correct because a mismatch between the display name and the actual sender address is a classic spoofing indicator, since attackers often set a trusted-looking display name while the underlying SMTP From or Return-Path domain is different. Option D is correct because when the visible URL text differs from the actual hyperlink target (for example, displayed as https://bank.example.com but linking to http://malicious.example.net), it indicates an attempt to deceive the recipient about the destination. Option C is not a reliable indicator, because legitimate emails commonly use standard corporate branding and attackers can easily replicate logos and templates. Option E is not a reliable indicator, since phishing messages can be sent at any time, including during business hours, and timing alone does not indicate malicious intent.

Answer

The email uses standard corporate branding

Answer

The email is sent during business hours

Question 7

Which action should be taken after an email incident is contained and the indicators are identified?

Accepted Answer

Update security controls and user awareness programs. After containment and identification of indicators of compromise (IOCs), the post-incident phase requires updating security controls (e.g., email filters, blocklists, detection rules) and strengthening user awareness training to prevent recurrence. This aligns with the lessons-learned step of the incident response lifecycle.

Answer

Ignore the event to focus on the next

Answer

Decommission the email server

Answer

Immediately delete all logs

Question 8

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

Accepted Answer

The email was scanned by Microsoft's filtering engine. This header provides information on how Microsoft's filtering engine analyzed the message, including spam confidence levels.

Answer

The email is definitely malicious

Answer

The sender is a known spammer

Answer

The email is encrypted

Question 9

You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?

Accepted Answer

Use a URL lookup or unshortening service. URL shortening services obscure the final destination, and clicking the link directly can expose the analyst or organization to malicious content. The safe, recommended method is to use a URL lookup or unshortening service that expands the link and reveals the final landing page without executing it in a browser. This allows inspection of the destination for phishing or malware indicators.

Answer

Click the link to see where it goes

Answer

Block all shortened links

Answer

Run a packet capture on the gateway

Question 10

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

Accepted Answer

Use the organization's 'Report Phishing' tool. Reporting the suspicious email through the provided 'Report Phishing' button is the most effective user action.

Answer

Reply to the sender to verify

Answer

Ignore and delete the email without reporting

Answer

Forward it to a friend for a second opinion

Question 11

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

Accepted Answer

Evaluating the performance of security controls. Option C (Evaluating the performance of security controls) is correct because a post-mortem analysis must determine whether existing controls such as email gateways, spam filters, attachment sandboxing, and endpoint detection actually detected, blocked, or failed to stop the malicious email, so that gaps can be remediated. Option D (Reviewing the incident response timeline and logs) is correct because reconstructing the sequence of events from email gateway logs, mail server logs, EDR telemetry, and analyst actions is essential to identify what happened, how quickly the team responded, and where the process can be improved. Option A is not a required post-mortem step; promotions are an HR matter unrelated to analyzing the incident. Option B is not always required; law enforcement is contacted only when the incident meets legal or organizational thresholds, not as a standard post-mortem step. Option E is wrong because deleting evidence destroys the data needed for root-cause analysis, timeline reconstruction, and any legal or compliance obligations.

Answer

Promoting the security analyst involved

Answer

Contacting the local law enforcement authorities

Answer

Deleting all evidence to maintain privacy

Question 12

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

Accepted Answer

DKIM. DKIM (A) is correct because it adds a cryptographic digital signature to outgoing messages, allowing the receiving server to verify that the message was actually sent by the claimed domain and was not altered in transit, which directly counters domain spoofing. SPF (B) is correct because it publishes a DNS TXT record listing the authorized sending hosts/IP addresses for a domain, so receivers can reject or flag mail sent from unauthorized servers impersonating that domain. DMARC (E) is correct because it builds on SPF and DKIM alignment, specifies a policy (none, quarantine, or reject) for messages failing authentication, and provides reporting, giving domain owners enforcement against spoofing. SSL/TLS (C) only encrypts data in transit between client and server and does not authenticate the sending domain of an email message, so it does not prevent spoofing. HTTP/2 (D) is a web transport protocol for HTTP traffic and is unrelated to email sender authentication or domain spoofing prevention.

Answer

SSL/TLS

Answer

HTTP/2

Question 13

Which THREE of the following items should be included in an email incident report?

Accepted Answer

Chronological timeline of the incident. A chronological timeline of the incident is correct because an incident report must document the sequence of events (detection, initial response, containment, and resolution timestamps) so responders and auditors can reconstruct what happened and when. C, a list of affected users or systems, is correct because scoping the incident—identifying exactly which mailboxes, endpoints, or accounts were compromised—is essential for containment, notification, and impact assessment. E, remediation steps taken, is correct because the report must record the corrective actions performed (for example, password resets, MFA enforcement, mailbox rule deletion, or message purging) to verify the incident was resolved and to support lessons-learned analysis. B is not included because personal contact information of the attacker is typically unknown, unverifiable, and irrelevant to the report's factual scope, and pursuing it is a law-enforcement matter. D is not included because a full history of every email ever sent to the user is excessive, unrelated to the specific incident, and would introduce privacy and data-minimization concerns.

Answer

Personal contact information of the attacker

Answer

Full history of every email ever sent to the user

Question 14

Which TWO of the following are safe practices when analyzing a suspicious email?

Accepted Answer

Ensuring the analysis environment is isolated from the network. Option C is correct because isolating the analysis environment from the network prevents any malicious payload from reaching command-and-control servers, exfiltrating data, or pivoting into production systems during examination. Option E is correct because an isolated virtual machine (VM) provides a disposable, sandboxed host where suspicious attachments or links can be detonated safely and then reverted via snapshots without risking the analyst's primary workstation. The remaining options are unsafe: A removes a critical defensive layer and exposes the host to malware, B risks executing malicious attachments in a production mail client with live credentials and data, and D can trigger drive-by downloads, tracking pixels, or credential-harvesting pages and may notify the attacker that the lure was opened.

Answer

Disabling all antivirus tools to observe behavior

Answer

Opening attachments in your primary email client

Answer

Clicking every link to check for live sites

Question 15

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Accepted Answer

Malicious URL within the email body. Option A is correct because a malicious URL embedded in the email body is a classic host- or network-based IOC that defenders can extract, block at the proxy/email gateway, and pivot on to find other recipients. Option C is correct because the sender IP address is a network-based IOC that can be checked against threat-intel feeds, blocklists, and SPF/DKIM authentication results to identify the originating infrastructure. Option D is correct because the MD5 or SHA-256 hash of an attachment is a file-based IOC that uniquely identifies the malicious payload and can be used for hash-blocking and endpoint/AV hunting. Option B does not belong because the name of the email service provider is a benign, generic attribute that does not by itself indicate compromise. Option E does not belong because a user's password is a credential, not an observable artifact of an attack, and its exposure would be a consequence rather than an IOC.

Answer

The name of the email service provider

Answer

The user's password