212-89 Timed Practice Test 1 — 10 Questions

Question 1

Which TWO of the following are safe practices when analyzing a suspicious email?

Accepted Answer

Ensuring the analysis environment is isolated from the network. Using virtual machines and disconnecting from the corporate network are safe practices.

Answer

Disabling all antivirus tools to observe behavior

Answer

Opening attachments in your primary email client

Answer

Clicking every link to check for live sites

Question 2

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Accepted Answer

Financial loss via unauthorized transfers. BEC targets employees to perform unauthorized financial transfers through social engineering.

Answer

System performance degradation

Answer

Infrastructure downtime

Answer

Spam distribution

Question 3

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

Accepted Answer

The sending IP is not listed in the domain's SPF record. A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.

Answer

The message was spoofed and must be blocked

Answer

The email has been encrypted with TLS

Answer

The email passed DKIM verification

Question 4

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

Accepted Answer

DKIM. SPF, DKIM, and DMARC are the three pillars of email authentication to prevent spoofing.

Answer

SSL/TLS

Answer

HTTP/2

Question 5

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

Accepted Answer

Corporate security intranet portal. Company-wide announcements, helpdesk tickets, and security awareness portals are appropriate channels.

Answer

Individual user personal phone numbers

Answer

Public social media accounts

Question 6

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

Accepted Answer

The email was scanned by Microsoft's filtering engine. This header provides information on how Microsoft's filtering engine analyzed the message, including spam confidence levels.

Answer

The email is definitely malicious

Answer

The sender is a known spammer

Answer

The email is encrypted

Question 7

Which TWO of the following describe the role of an email gateway in incident response?

Accepted Answer

Filtering and blocking malicious content. Email gateways act as a filter for incoming threats and provide logs for post-incident investigation.

Answer

Replacing all passwords automatically

Answer

Manually deleting user account files

Answer

Encrypting all outgoing traffic

Question 8

Which TWO types of evidence are considered 'volatile'?

Accepted Answer

System memory (RAM).. RAM and network connections are lost when power is removed or the system is reset.

Answer

Optical disc contents.

Answer

Hard drive data.

Answer

Printed log files.

Question 9

Which TWO of the following are valid methods to identify a malicious attachment?

Accepted Answer

Performing behavioral analysis in a sandbox. Analyzing file hashes against threat intelligence and performing behavioral analysis in a sandbox are valid methods.

Answer

Forwarding the email to the entire company

Answer

Opening the attachment on a personal device

Answer

Deleting the attachment based on its size

Question 10

Which THREE of the following items should be included in an email incident report?

Accepted Answer

Chronological timeline of the incident. A description of the incident, the impact, and the remediation steps are required for a report.

Answer

Personal contact information of the attacker

Answer

Full history of every email ever sent to the user