Email Incidents

An attacker compromises a user's Microsoft 365 mailbox and creates an inbox rule that moves all messages from the CFO to the 'RSS Feeds' folder and marks them as read. The user never sees these messages. Which type of email incident does this behavior most directly represent?

During an email incident investigation, an analyst needs to determine the originating IP address of a message that passed through multiple mail servers. The message headers contain several 'Received' fields. Which action should the analyst take to identify the true origin?

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Which action should be taken after an email incident is contained and the indicators are identified?

During an email incident investigation, an analyst extracts a suspicious macro-enabled document from a reported message. The document contains obfuscated VBA code that downloads a payload from a remote host. The analyst wants to safely determine the payload's network behavior without allowing execution on a production workstation. Which approach BEST supports this goal?

A user reports that they received an email from 'IT Support' asking them to click a link to reset their password. The link goes to a domain that looks similar to the company's but has a different top-level domain. The user did not click the link. What is the FIRST action the incident handler should take?

An analyst is investigating an email incident where several users received messages with a link to a legitimate file-sharing service. The link points to a document hosted on that service, and the document contains a macro that downloads a payload. The email gateway did not block the message because the link domain is reputable. Which technique is the attacker most likely using to evade email security controls?

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

When DKIM signature verification fails, what is the most likely technical cause?

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

A user reports an email claiming to be from the IT helpdesk that asks them to click a link and re-enter their credentials because their mailbox is full. The user has not clicked the link. According to the Certified Incident Handler process, what is the most appropriate immediate action?

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

An employee receives a message that appears to come from the CEO asking for an urgent gift card purchase, and the reply-to address is a free webmail account. The employee reports it without clicking anything. Which containment action is most appropriate at this stage?

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

An incident handler is investigating a suspected email compromise and discovers a new inbox rule that automatically moves messages containing specific keywords to the Deleted Items folder. What is the most likely purpose of this rule?

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

A helpdesk technician receives a call from an employee who says they opened an email attachment that appeared to be an invoice, and now their computer is showing a message demanding payment to unlock files. The employee's documents are encrypted and have a new file extension. The technician escalates to the incident response team. Which classification BEST describes this incident?

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Which TWO of the following describe the role of an email gateway in incident response?

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

An organization is responding to an email incident where a user's mailbox is suspected to be compromised and used to send internal phishing emails. Which two actions should the incident handler take to contain the compromise and prevent further spread? (Choose two.)

Which THREE of the following are common indicators of a phishing email?

A user reports receiving an email with a .zip attachment that is password-protected and the password is included in the email body. The email claims to be an invoice from a known vendor. What is the most likely reason for this?

A user reports an email that appears to come from the CFO but the message was sent from an external IP address. The message passed SPF but failed DMARC alignment. What should the incident handler do first?

During an email incident investigation, you need to determine whether a message was altered in transit. You have the full email headers. Which header field should you examine to verify the cryptographic signature that validates the message content and ensures it was not modified after sending?

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

A user reports an email from a known vendor that asks them to confirm banking details by replying with a completed form attached as an HTML file. The message passed SPF, DKIM, and DMARC because it came from the vendor's legitimate mail server. As the incident handler, what is the most accurate conclusion about this email?

An incident responder is investigating a suspected email-borne malware incident. The email contained a link that downloaded a file. The responder needs to determine the file's reputation and whether it has been seen in other campaigns. Which action should the responder take?

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

An incident handler is analyzing a reported email that appears to come from a trusted partner. The message passed SPF and DKIM for the partner's domain, but the handler notices the display name matches the partner while the actual From address uses a look-alike domain with a single character difference. The message also contains a link to a document-sharing site. Which conclusion is MOST accurate?

You are handling a confirmed email incident involving a malicious attachment that executed on several endpoints. Which TWO actions should you take to scope the incident and prevent further execution across the organization? (Choose two.)

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

An attacker compromises a user's Microsoft 365 mailbox and creates a hidden inbox rule that moves any message containing 'wire transfer' to the RSS Feeds folder and marks it as read. The security team must determine which native artifact best proves the rule existed even after the attacker deletes it from Outlook on the web. What should the team review?

An incident handler is reviewing a suspicious email reported by a finance employee. The message appears to come from a known vendor, requests an urgent wire transfer, and contains a PDF attachment. The handler wants to determine whether the sender's domain was authorized to send on behalf of the vendor. Which email authentication result should the handler check FIRST to make this determination?

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Which TWO of the following are safe practices when analyzing a suspicious email?

You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?

During an email incident investigation, you need to analyze a malicious macro embedded in a Word document without executing it. Which tool is most appropriate for extracting and examining the macro code?

What is the purpose of 'Sandboxing' in email security?

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Which THREE of the following items should be included in an email incident report?

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Which TWO of the following are valid methods to identify a malicious attachment?

An incident responder is examining a suspected business email compromise (BEC) message. The message passed SPF, DKIM, and DMARC alignment checks. The From display name is the CEO's name, but the actual envelope sender is a lookalike domain registered two days ago. Which characteristic of this message most directly explains why the authentication checks succeeded while the message is still malicious?