212-89 Email Incidents Practice Test 3 — 15 Questions

Question 1

Which TWO of the following describe the role of an email gateway in incident response?

Accepted Answer

Filtering and blocking malicious content. Option B is correct because an email gateway sits inline between the internet and the mail server, where it performs content filtering, anti-spam, anti-malware, and URL/attachment sandboxing to block phishing, malicious attachments, and other threats before they reach user inboxes. Option D is correct because the gateway generates and retains SMTP transaction logs, message headers, and quarantine records that provide valuable evidence during incident response, allowing analysts to trace sender IPs, message IDs, and delivery timelines. Options A, C, and E are not roles of an email gateway in incident response: password replacement is handled by directory services or IAM tooling, manual file deletion is an endpoint/administrator action, and while TLS encryption may be supported for transport, encrypting all outgoing traffic is not an incident-response function of the gateway.

Answer

Replacing all passwords automatically

Answer

Manually deleting user account files

Answer

Encrypting all outgoing traffic

Question 2

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Accepted Answer

Corporate security intranet portal. Option B (Corporate security intranet portal) is correct because it is an authenticated, company-controlled channel where the security team can post authoritative incident updates and phishing indicators that employees already trust and routinely access. Option D (Official company-wide security alert email) is correct because it leverages the organization's existing mass-notification capability to reach all staff quickly with consistent guidance, even though email is the affected vector, since the alert is outbound and does not require users to click suspicious links. Option E (Internal helpdesk ticketing system status page) is correct because it provides a monitored, centralized location for real-time status updates and instructions, reducing inbound ticket volume while giving users a verified source of truth. Option A (Individual user personal phone numbers) is not appropriate because personal numbers are outside corporate control, raise privacy and consent issues, and are impractical for mass notification during an incident. Option C (Public social media accounts) is not appropriate because public channels can expose sensitive incident details, invite attacker impersonation and misinformation, and are not a reliable or secure way to reach internal users.

Answer

Individual user personal phone numbers

Answer

Public social media accounts

Question 3

Which TWO of the following are valid methods to identify a malicious attachment?

Accepted Answer

Performing behavioral analysis in a sandbox. Option B is correct because executing a suspicious attachment in an isolated sandbox lets analysts observe its runtime behavior—such as file system changes, registry modifications, network callbacks, and process creation—which reliably reveals malicious intent without risking production systems. Option C is correct because computing the file's cryptographic hash (e.g., MD5, SHA-1, or SHA-256) and comparing it to threat intelligence databases like VirusTotal or an internal IOC repository quickly determines whether the sample matches known malware. Option A is wrong because forwarding a potentially malicious attachment to the entire company propagates the threat and can trigger widespread compromise. Option D is wrong because opening the attachment on a personal device exposes that device and its data to infection and provides no controlled analysis. Option E is wrong because file size is not an indicator of maliciousness, so deleting based on size alone would both miss real threats and remove benign files.

Answer

Forwarding the email to the entire company

Answer

Opening the attachment on a personal device

Answer

Deleting the attachment based on its size

Question 4

A user reports an email that appears to come from the CFO but the message was sent from an external IP address. The message passed SPF but failed DMARC alignment. What should the incident handler do first?

Accepted Answer

Quarantine the email and verify the sender's identity through a separate communication channel.. The email passed SPF but failed DMARC alignment, meaning the sending IP is authorized for a domain but not the visible From domain. This indicates spoofing. Quarantining the message and verifying the request through a separate channel are critical first steps to prevent fraud and contain the incident.

Answer

Delete the email from the user's mailbox and take no further action.

Answer

Forward the email to all employees as a warning about phishing attempts.

Answer

Reply to the email asking for confirmation of the request.

Question 5

An attacker compromises a user's Microsoft 365 mailbox and creates an inbox rule that moves all messages from the CFO to the 'RSS Feeds' folder and marks them as read. The user never sees these messages. Which type of email incident does this behavior most directly represent?

Accepted Answer

Business email compromise (BEC) with mailbox rule abuse. The attacker compromised a mailbox and configured a hidden inbox rule to suppress messages from the CFO, which is a signature of business email compromise with mailbox rule abuse. This allows the attacker to intercept financial communications, impersonate the executive, and initiate fraudulent transfers without the user noticing. The other options describe earlier-stage or unrelated email threats that do not match the post-compromise mail-flow manipulation shown.

Answer

Spam campaign targeting multiple recipients

Answer

Malware outbreak via a malicious attachment

Answer

Phishing email delivered to the user's inbox

Question 6

An attacker compromises a user's Microsoft 365 mailbox and creates a hidden inbox rule that moves any message containing 'wire transfer' to the RSS Feeds folder and marks it as read. The security team must determine which native artifact best proves the rule existed even after the attacker deletes it from Outlook on the web. What should the team review?

Accepted Answer

The mailbox audit log entries for the New-InboxRule and Set-InboxRule operations. Server-side inbox rules are created and modified through auditable operations, so the mailbox audit log retains the New-InboxRule and Set-InboxRule events with full parameters even after the rule is deleted. This makes it the reliable evidence source, whereas client caches, message trace, and connector settings do not capture rule creation or parameters.

Answer

The message trace log filtered to the user's primary SMTP address

Answer

The Exchange Online connector configuration for the affected tenant

Answer

The Outlook client-side rules (.rwz) file cached in the user's local profile

Question 7

An incident responder is examining a suspected business email compromise (BEC) message. The message passed SPF, DKIM, and DMARC alignment checks. The From display name is the CEO's name, but the actual envelope sender is a lookalike domain registered two days ago. Which characteristic of this message most directly explains why the authentication checks succeeded while the message is still malicious?

Accepted Answer

The lookalike domain published its own SPF, DKIM, and DMARC records that align with its own domain, so authentication passes for that domain even though it impersonates the CEO's display name.. Email authentication validates the domain that sent the message, not the display name shown to the user. A lookalike domain can publish its own SPF, DKIM, and DMARC records and pass all checks for itself, allowing a BEC message to appear legitimate. Incident handlers must inspect the actual envelope sender and domain age, not rely solely on authentication results.

Answer

The message used a compromised internal mailbox with a valid SPF record, so the sending IP passed SPF.

Answer

The receiving gateway disabled DMARC enforcement for executive names, which is why the checks passed.

Answer

The message was sent through a reputable bulk email service, which automatically signs all outbound mail with the recipient's domain keys.

Question 8

A user reports an email from a known vendor that asks them to confirm banking details by replying with a completed form attached as an HTML file. The message passed SPF, DKIM, and DMARC because it came from the vendor's legitimate mail server. As the incident handler, what is the most accurate conclusion about this email?

Accepted Answer

It may be a business email compromise sent from the vendor's compromised mailbox despite valid authentication. Authentication results confirm the sending domain, not the sender's intent. A compromised vendor mailbox produces messages that pass SPF, DKIM, and DMARC while carrying a fraudulent request, which matches the business email compromise pattern. The handler should verify the banking change through a known-good channel before acting on the attachment.

Answer

It is a legitimate message because all three authentication checks passed

Answer

It is a spoofed message and the authentication results must be incorrect

Answer

It should be quarantined automatically because HTML attachments are always malicious

Question 9

A user reports receiving an email with a .zip attachment that is password-protected and the password is included in the email body. The email claims to be an invoice from a known vendor. What is the most likely reason for this?

Accepted Answer

The sender is trying to bypass antivirus detection by encrypting the payload.. Password-protected ZIP attachments with the password in the email body are a classic malware delivery technique. The encryption prevents antivirus scanning, and the password allows the user to open the file, often leading to infection. This is a strong indicator of a malicious email.

Answer

The email is a legitimate invoice that requires a password to comply with company policy.

Answer

The vendor is using a secure method to protect sensitive financial data.

Answer

The attachment is a compressed file to reduce email size and the password is for added security.

Question 10

A user reports an email claiming to be from the IT helpdesk that asks them to click a link and re-enter their credentials because their mailbox is full. The user has not clicked the link. According to the Certified Incident Handler process, what is the most appropriate immediate action?

Accepted Answer

Report the email to the security team and preserve it as evidence without clicking any links.. When a user reports a suspected phishing email, the immediate priority is to prevent credential theft and preserve evidence. The user should not interact with the message, and the security team should be notified so the message can be analyzed and the campaign blocked. Deleting or forwarding the email prematurely can destroy evidence or spread the threat.

Answer

Instruct the user to delete the email and empty the deleted items folder.

Answer

Click the link from a sandboxed virtual machine to see where it leads.

Answer

Forward the email to all staff as a warning about phishing.

Question 11

An incident handler is investigating a suspected email compromise and discovers a new inbox rule that automatically moves messages containing specific keywords to the Deleted Items folder. What is the most likely purpose of this rule?

Accepted Answer

To hide evidence of fraud or other malicious activity by suppressing related emails.. The presence of a hidden inbox rule that deletes messages containing specific keywords is a strong indicator of email compromise. Attackers use such rules to suppress notifications and replies that could reveal their fraudulent activities, allowing them to operate undetected.

Answer

To reduce mailbox clutter by automatically deleting spam messages.

Answer

To comply with data retention policies by removing old emails.

Answer

To automatically organize legitimate newsletters and promotional emails.

Question 12

An analyst is investigating an email incident where several users received messages with a link to a legitimate file-sharing service. The link points to a document hosted on that service, and the document contains a macro that downloads a payload. The email gateway did not block the message because the link domain is reputable. Which technique is the attacker most likely using to evade email security controls?

Accepted Answer

Using a legitimate cloud service to host the malicious document, which bypasses reputation-based filtering.. Hosting malicious documents on legitimate cloud services is an effective evasion because email gateways often trust well-known domains. The gateway sees a reputable URL and allows the message, while the document itself contains the malicious macro. Incident handlers should treat links to trusted services with the same scrutiny as any other link, especially when the document requests macro enablement.

Answer

Domain fronting to hide the true destination behind a trusted CDN.

Answer

Encrypting the email with S/MIME so the gateway cannot inspect the content.

Answer

Sending the message from a compromised internal account to bypass SPF checks.

Question 13

During an email incident investigation, you need to determine whether a message was altered in transit. You have the full email headers. Which header field should you examine to verify the cryptographic signature that validates the message content and ensures it was not modified after sending?

Accepted Answer

DKIM-Signature. The DKIM-Signature header holds the cryptographic signature that validates the message content and certain headers. By verifying this signature, an investigator can determine whether the message was altered in transit and whether it was authorized by the sending domain. The other headers provide routing or identification information but lack cryptographic integrity protection.

Answer

Return-Path

Answer

Received

Answer

Message-ID

Question 14

During an email incident investigation, an analyst needs to determine the originating IP address of a message that passed through multiple mail servers. The message headers contain several 'Received' fields. Which action should the analyst take to identify the true origin?

Accepted Answer

Read the 'Received' headers from bottom to top, as the bottom-most entry is the first server that handled the message.. Received headers are appended by each mail server that handles the message, with the oldest at the bottom. To find the originating IP, the analyst should read from bottom to top. The bottom-most Received header usually contains the IP address of the sender's mail server, providing the best indication of the true origin.

Answer

Check the 'Message-ID' header, which encodes the originating IP in its domain portion.

Answer

Read the 'Received' headers from top to bottom, because the top-most entry is the originating server.

Answer

Use the 'Return-Path' header, which always contains the originating IP address.

Question 15

During an email incident investigation, you need to analyze a malicious macro embedded in a Word document without executing it. Which tool is most appropriate for extracting and examining the macro code?

Accepted Answer

olevba from the oletools suite. olevba is designed specifically for static analysis of VBA macros in Office documents. It extracts macro code, highlights suspicious keywords, and helps analysts understand the macro's behavior without executing it, which is critical for safe incident response.

Answer

Volatility

Answer

Wireshark

Answer

Nmap