30 questions · Email Incidents · All types, answers revealed
What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?
This is the primary motive.
Why this answer
BEC targets employees to perform unauthorized financial transfers through social engineering.
Which action should be taken after an email incident is contained and the indicators are identified?
This is the standard post-incident step.
Why this answer
Post-incident activities include updating policies and procedures to prevent recurrence.
Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?
DMARC defines the policy.
Why this answer
DMARC provides the policy instructions for SPF and DKIM failures.
When DKIM signature verification fails, what is the most likely technical cause?
Modification breaks the cryptographic hash.
Why this answer
DKIM verification fails if the body content or headers were altered after signing.
While analyzing an email header, you observe an SPF 'softfail'. What does this imply?
This is the definition of a softfail.
Why this answer
A softfail (~all) indicates the server is not explicitly authorized but the domain owner is not strictly enforcing rejection.
You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?
Designed for macro analysis.
Why this answer
Oledump is the industry standard tool for identifying and extracting macros from Office documents.
Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?
Necessary to improve future detection.
Why this answer
Reviewing incident logs and evaluating the effectiveness of security controls are critical post-mortem steps.
Which THREE of the following email security technologies should be configured to prevent domain spoofing?
Authenticates message integrity.
Why this answer
SPF, DKIM, and DMARC are the three pillars of email authentication to prevent spoofing.
An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?
This tool allows removing emails from mailboxes.
Why this answer
Search and Purge within the Microsoft 365 Defender portal is the standard tool for post-delivery removal.
If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?
Containment prevents further spread.
Why this answer
After detection, containment is the critical priority to prevent further impact.
An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?
Punycode exposes the fake characters.
Why this answer
Homograph attacks use look-alike characters (like Cyrillic 'а' instead of Latin 'a') that are visible when inspecting the Punycode version of the domain.
Which TWO of the following describe the role of an email gateway in incident response?
Proactive protection.
Why this answer
Email gateways act as a filter for incoming threats and provide logs for post-incident investigation.
An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?
This alerts the security team.
Why this answer
Reporting the suspicious email through the provided 'Report Phishing' button is the most effective user action.
Which THREE of the following are common indicators of a phishing email?
Urgency is used to bypass critical thinking.
Why this answer
Suspicious sender domains, mismatched URLs, and sense of urgency are primary phishing indicators.
You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?
Windows often hides the final extension.
Why this answer
The double extension is a common technique to trick users into executing a binary file.
When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?
Safe detonation is the primary first step.
Why this answer
Before interaction, you must detonate in a sandbox to ensure safety.
An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?
This promotes trust and cooperation.
Why this answer
The tone should be professional, reassuring, and helpful to encourage future reporting.
Which of the following is a symptom of an 'Email Forwarding Rule' attack?
This is the hallmark of the attack.
Why this answer
Attackers set up auto-forwarding rules to intercept sensitive business communications without the user's knowledge.
An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?
Broad SPF records allow unauthorized senders.
Why this answer
If SPF passes but the IP is wrong, it is likely the attacker is using an email service that is part of the same SPF-authorized infrastructure (like a shared cloud provider).
Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?
Common phishing IOC.
Why this answer
Sender IP addresses, malicious URLs, and file hashes are standard IOCs.
Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?
Appropriate for awareness.
Why this answer
Company-wide announcements, helpdesk tickets, and security awareness portals are appropriate channels.
An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?
This header is specific to Microsoft services.
Why this answer
This header provides information on how Microsoft's filtering engine analyzed the message, including spam confidence levels.
When an email incident is resolved, why is it necessary to update the organization's blocklist?
This is the core purpose of blocklisting.
Why this answer
Updating the blocklist prevents future delivery of emails from the same source or with the same malicious artifacts.
Which TWO of the following are safe practices when analyzing a suspicious email?
Prevents data exfiltration.
Why this answer
Using virtual machines and disconnecting from the corporate network are safe practices.
You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?
This is the safe way to resolve redirects.
Why this answer
Using a 'URL unshortening' service or tool allows the analyst to see the final destination without clicking the link.
What is the purpose of 'Sandboxing' in email security?
This is the core function.
Why this answer
Sandboxing executes a file in a controlled, virtual environment to observe its behavior before allowing it to reach the end user.
An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?
This header tracks the path through servers.
Why this answer
The Received header is added by every MTA that handles the message, providing a verifiable path.
Which THREE of the following items should be included in an email incident report?
Essential for reconstruction.
Why this answer
A description of the incident, the impact, and the remediation steps are required for a report.
If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?
This is the primary evasion goal.
Why this answer
Password protection hides the file contents from automated antivirus scanners.
Which TWO of the following are valid methods to identify a malicious attachment?
Effective for unknown malware.
Why this answer
Analyzing file hashes against threat intelligence and performing behavioral analysis in a sandbox are valid methods.
Ready to test yourself?
Try a timed practice session using only Email Incidents questions.