212-89 Email Incidents — Timed 10 Questions

Question 1

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

Accepted Answer

Run the URL against an automated sandbox analysis tool. Running the URL against an automated sandbox analysis tool is the safest first step because it detonates or inspects the URL in an isolated environment, revealing malicious behavior without exposing the analyst's system or the organization. This aligns with phishing triage best practices of analysis before action. Clicking the URL directly or forwarding to a user risks compromise.

Answer

Click the URL to inspect the landing page

Answer

Block the sender domain immediately

Answer

Forward the email to the user for confirmation

Question 2

An incident responder is examining a suspicious email that contains a link to a credential-harvesting page. The link uses a URL shortener and redirects through multiple domains. Which TWO of the following actions are appropriate for safely analyzing the link? (Choose two.)

Accepted Answer

Use a URL expander service to reveal the final destination without visiting it.. Submitting the URL to a sandbox and using a URL expander are safe methods to analyze a suspicious link without exposing the responder or organization to risk. These techniques reveal the final destination and any malicious behavior in a controlled manner.

Answer

Forward the email to a colleague in the security team and ask them to click the link.

Answer

Open the link in a virtual machine with a standard corporate image to see the page.

Answer

Copy the link and paste it into a browser on the responder's workstation.

Question 3

A user reports receiving an email that appears to come from the CEO asking for an urgent wire transfer. The email passes SPF and DKIM checks. Which two characteristics most strongly indicate this is a business email compromise (BEC) rather than a spoofed message? (Choose two.)

Accepted Answer

The reply-to address differs from the From address and belongs to an external domain.. BEC attacks often use compromised or lookalike accounts that pass SPF and DKIM, so authentication success does not rule out fraud. The reply-to mismatch and recently registered lookalike domain are the strongest indicators because they reveal the attacker's intent to impersonate an executive while controlling responses. Malicious attachments, DMARC failures, and credential-harvesting links point to different email threat categories.

Answer

The message fails DMARC alignment for the displayed From domain.

Answer

The email includes a link to a credential-harvesting page.

Answer

The email contains a malicious macro-enabled attachment.

Question 4

During an email incident, you obtain a suspicious message in .eml format. You need to extract the actual sender IP and verify the message path without altering any evidence. Which action best preserves forensic integrity while giving you the data you need?

Accepted Answer

Open the .eml in a text editor and inspect the Received headers from the bottom of the list upward. Received headers are added in order as the message moves between servers, so the bottom-most entry reflects the earliest hop and the originating IP. Inspecting a copy in a text editor is non-destructive and yields the full header chain, while forwarding or rendering the message rewrites or alters it and risks notifying the attacker.

Answer

Open the .eml in the mail client and use the Print to PDF option to capture the headers

Answer

Open the attachment in a sandbox and read the SMTP envelope fields from the sandbox report

Answer

Forward the .eml to your own mailbox and read the headers in the received copy

Question 5

When DKIM signature verification fails, what is the most likely technical cause?

Accepted Answer

The body of the message was modified in transit. DKIM uses a cryptographic signature over specified headers and the message body. If the body is modified in transit, the hash computed by the receiver will not match the signature, causing verification to fail. This is the most likely technical cause of DKIM failure.

Answer

The sender's IP address is on a blocklist

Answer

The user clicked a phishing link

Answer

The SPF record is missing

Question 6

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

Accepted Answer

Search and Purge in Microsoft 365 Defender. Search and Purge in Microsoft 365 Defender (formerly Office 365 Advanced Threat Protection) allows administrators to search for and delete malicious emails from all user mailboxes. This feature is designed specifically for incident response to remove phishing or malware emails globally, ensuring they cannot be accessed by users. It supports searching by sender, subject, or other criteria and can purge messages from all mailboxes in the organization.

Answer

Conditional Access policies

Answer

Exchange Transport Rules

Answer

Mail Flow Connector configuration

Question 7

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Accepted Answer

The file is a double-extension obfuscation attempt. A filename like 'invoice.pdf.exe' uses a double extension to disguise an executable as a PDF. Windows hides known file extensions by default, so the file may appear as 'invoice.pdf' to the user, but it actually runs as an .exe. This is a classic social-engineering technique to trick users into executing malware.

Answer

The file is a legitimate script file

Answer

The file is encrypted with a password

Answer

The file is a genuine PDF that requires an executable

Question 8

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM by allowing domain owners to publish a policy that instructs receivers on how to handle emails that fail SPF and/or DKIM alignment checks. It also provides reporting mechanisms. SPF authenticates the sending server, DKIM cryptographically signs the message, and DMARC ties them together with a policy.

Answer

SMTPS

Answer

IMAP

Answer

POP3

Question 9

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 10

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Accepted Answer

Received. The 'Received' header field is added by each mail transfer agent (MTA) as the message passes through it, creating a chronological list of hops. It is the most reliable field for tracing the path an email took, including originating IP and intermediate servers. Analysts read Received headers from bottom to top to follow the actual delivery chain.

Answer

X-Originating-IP

Answer

Return-Path

Answer

X-Mailer