20+ practice questions focused on Email Incidents — one of the most tested topics on the Certified Incident Handler (212-89) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Email Incidents PracticeWhen performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?
Explanation: Running the URL against an automated sandbox analysis tool is the safest first step because it detonates or inspects the URL in an isolated environment, revealing malicious behavior without exposing the analyst's system or the organization. This aligns with phishing triage best practices of analysis before action. Clicking the URL directly or forwarding to a user risks compromise.
An incident responder is examining a suspicious email that contains a link to a credential-harvesting page. The link uses a URL shortener and redirects through multiple domains. Which TWO of the following actions are appropriate for safely analyzing the link? (Choose two.)
Explanation: Submitting the URL to a sandbox and using a URL expander are safe methods to analyze a suspicious link without exposing the responder or organization to risk. These techniques reveal the final destination and any malicious behavior in a controlled manner.
A user reports receiving an email that appears to come from the CEO asking for an urgent wire transfer. The email passes SPF and DKIM checks. Which two characteristics most strongly indicate this is a business email compromise (BEC) rather than a spoofed message? (Choose two.)
Explanation: BEC attacks often use compromised or lookalike accounts that pass SPF and DKIM, so authentication success does not rule out fraud. The reply-to mismatch and recently registered lookalike domain are the strongest indicators because they reveal the attacker's intent to impersonate an executive while controlling responses. Malicious attachments, DMARC failures, and credential-harvesting links point to different email threat categories.
During an email incident, you obtain a suspicious message in .eml format. You need to extract the actual sender IP and verify the message path without altering any evidence. Which action best preserves forensic integrity while giving you the data you need?
Explanation: Received headers are added in order as the message moves between servers, so the bottom-most entry reflects the earliest hop and the originating IP. Inspecting a copy in a text editor is non-destructive and yields the full header chain, while forwarding or rendering the message rewrites or alters it and risks notifying the attacker.
When DKIM signature verification fails, what is the most likely technical cause?
Explanation: DKIM uses a cryptographic signature over specified headers and the message body. If the body is modified in transit, the hash computed by the receiver will not match the signature, causing verification to fail. This is the most likely technical cause of DKIM failure.
+15 more Email Incidents questions available
Practice all Email Incidents questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Email Incidents. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Email Incidents questions on the 212-89 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Email Incidents is tested as part of the Certified Incident Handler (212-89) blueprint. Practicing with targeted Email Incidents questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 212-89 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Email Incidents is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Email Incidents practice session with instant scoring and detailed explanations.
Start Email Incidents Practice →