CCNA Email Incidents Questions

This is correct because the attacker used a compromised mailbox to silently divert CFO communications, a hallmark of BEC. The hidden rule enables invoice fraud and wire transfer manipulation by preventing the victim from seeing warnings or replies. The rule hiding messages from a senior executive is a classic post-compromise persistence and collection technique in business email compromise incidents.

Received headers are added as the message passes through each mail server, with the oldest entry at the bottom. Reading from bottom to top traces the path from the originating server to the final delivery. The bottom-most Received header typically contains the IP address of the sender's mail server, which is the closest to the true origin.

BEC attacks impersonate executives to trick staff into wiring funds or changing payment details, so the primary business impact is direct financial loss through unauthorised transfers. Other consequences such as reputational damage or data theft are secondary to the immediate monetary fraud this scenario targets.

Updating security controls and user awareness programmes directly addresses the root cause once containment and indicator identification are complete. This satisfies the stem's post-incident requirement by preventing recurrence, closing the gap that allowed the email incident, and hardening both technical defences and human behaviour against the same attack vector.

A sandboxed malware analysis service executes the sample in an instrumented, isolated environment and captures network traffic, dropped files, and process behavior. This allows the analyst to identify the payload's remote hosts and protocols without risking production systems. It is the most controlled and repeatable way to determine network behavior for a macro-enabled document in an incident response context.

This is correct because the first step in handling a suspected phishing email is to preserve evidence and escalate. Collecting the full email with headers allows analysts to extract indicators, verify the sender, and determine if others received the same message. Reporting to the security team initiates the incident response process and enables blocking and user awareness actions.

Attackers increasingly host malicious documents on trusted cloud services because email gateways often allow links to well-known domains. The gateway sees a reputable URL and does not block it, while the hosted document contains the malicious macro. This technique leverages the trust placed in the cloud service's domain to evade reputation-based detection.

DMARC builds on SPF and DKIM alignment, letting the domain owner publish a policy telling receivers whether to quarantine, reject or monitor messages failing authentication. SPF and DKIM alone verify origin but carry no handling instructions.

DKIM signs selected headers and the body, so any alteration to the message body after signing invalidates the hash comparison. This directly satisfies the stem's constraint that verification failed due to content modification in transit.

This is the definition of a softfail.

The first step in handling a suspected phishing email is to report it to the security team and preserve the original message, including full headers, so it can be analyzed. Instructing the user not to interact with the message prevents credential compromise. This aligns with the containment and evidence preservation phases of incident handling.

Oledump parses OLE compound-file structures and extracts embedded VBA macro streams from Word documents without executing them, exposing the source code for inspection. This satisfies the static-analysis constraint: the analyst reads the macro's code directly rather than detonating it in a sandbox.

Blocking the sender and searching for other recipients limits the blast radius of the campaign and identifies colleagues who may have already acted on it. It is proportionate to a reported, unclicked phishing message and gives the handler the scope needed to decide whether further containment, such as credential resets, is warranted.

Post-mortem analysis requires assessing whether existing security controls performed as intended during the incident, identifying gaps that allowed delivery or detection failure. This evaluation directly informs remediation and control hardening, satisfying the review's requirement to determine why controls did not prevent or flag the email threat.

DKIM adds a cryptographic signature to outbound mail, letting receivers verify the message genuinely originated from the signing domain and was not altered. This directly counters domain spoofing by proving authenticity, satisfying the requirement to prevent forged sender domains.

Search and Purge locates messages by sender, subject or URL across all mailboxes, then deletes them tenant-wide, including copies already delivered. This satisfies the global removal requirement that per-mailbox deletion or transport rules cannot achieve after delivery.

Attackers often create inbox rules to automatically delete or move emails that could alert the user or security team, such as notifications from banks or colleagues questioning suspicious requests. This helps them maintain persistence and avoid detection while carrying out fraud or data theft.

With the gateway already bypassed, containment is the immediate priority: removing the message from mailboxes and mail flow stops further user interaction and payload delivery. This limits scope before eradication and recovery, satisfying the stem's next-step requirement after perimeter failure.

The encryption of files, the new file extension, and the payment demand are hallmark indicators of ransomware. The initial vector was an email attachment, but the resulting incident type is ransomware because the impact is data encryption and extortion. This classification drives the appropriate response actions, including isolation, containment, and recovery from backups.

Homograph attacks substitute visually similar Unicode characters for Latin letters, so the rendered domain looks legitimate. Browsers convert such internationalised domains into ASCII-compatible Punycode (xn-- prefix). Inspecting that Punycode representation exposes the non-Latin characters, revealing the spoofed domain that visual inspection alone would miss.

The gateway inspects inbound and outbound mail, applying reputation, signature and content rules to quarantine or reject malicious messages before delivery. This filtering and blocking satisfies the stem's requirement, since it prevents threats reaching mailboxes and is a core incident-response containment control.

Using the organisation's 'Report Phishing' tool routes the suspicious message to security teams, enabling them to block the sender and warn other recipients. This satisfies the stem's mitigation constraint by preventing further exposure across the organisation, rather than merely protecting the single employee who received it.

Attackers often create inbox rules to hide replies, forward messages to external addresses, or delete evidence. These rules can persist even after a password reset, allowing continued data exfiltration or concealment. Removing them is essential to fully contain the compromise and prevent ongoing unauthorized access to email content.

Urgent or threatening language pressuring immediate action is a classic social-engineering indicator, exploiting time pressure to bypass scrutiny. It satisfies the question's requirement for a common phishing indicator, alongside sender-domain anomalies and suspicious links or attachments. Such coercion frequently precedes credential harvesting or malware delivery.

Password-protected archives are commonly used by attackers to evade antivirus scanning, as the contents cannot be inspected without the password. Including the password in the email body allows the recipient to open it, while security tools cannot scan the encrypted file. This is a red flag for malware delivery.

The email passed SPF but failed DMARC alignment, indicating a spoofed sender. Quarantining prevents further spread, and verifying via a separate channel (e.g., phone call) confirms the legitimacy of the request. This aligns with incident handling best practices for suspected business email compromise.

This is correct because the DKIM-Signature header contains the cryptographic signature that covers specified headers and the body. Verifying this signature confirms the message was not altered in transit and was sent by an authorized server for the domain. In an incident investigation, a valid DKIM signature helps rule out content tampering, while a failed or missing signature raises suspicion.

The double extension exploits Windows' default behaviour of hiding known file extensions, so 'invoice.pdf.exe' displays as 'invoice.pdf' in Explorer. The executable extension remains .exe, meaning the attachment runs code rather than opening as a document — satisfying the stem's suspicious-attachment indicator.

When a legitimate account is compromised, the attacker sends from the real mailbox and infrastructure, so SPF, DKIM, and DMARC all pass. The fraudulent banking request and the HTML attachment are content-level indicators, so the handler should treat it as a business email compromise and verify with the vendor through a separate channel.

This is correct because submitting the file hash to a threat intelligence platform allows the responder to check if the file has been previously identified, what family it belongs to, and whether it is associated with known campaigns. This provides reputation data and helps determine if the incident is part of a broader attack, guiding containment and remediation efforts.

A phishing reporter needs clear, factual guidance without alarm or blame, so they understand what happened and what to do next. A professional, calm, informative tone preserves trust and encourages prompt reporting of future attempts.

The single-character difference in the From domain is a classic look-alike domain technique used to deceive recipients. Even though SPF and DKIM passed for the partner's domain, those results do not apply to the look-alike domain in the visible From address. The handler should treat the message as suspicious, analyze the link, and check DMARC alignment for the look-alike domain to confirm the spoofing attempt.

Enumerating every recipient of the same message defines the true scope and reveals endpoints that may already be compromised. Without this step, containment is based on guesswork and additional executions can occur on machines the handler did not know received the message.

Forwarding to an external address directly evidences the attacker-created inbox rule, which silently redirects mail outside the organisation. This satisfies the stem's requirement for a symptom, since the unauthorised external recipient is the observable artefact of the rule, unlike mailbox quota or login anomalies.

An overly permissive SPF record, such as one ending in `+all` or including wide CIDR ranges, authorises IP addresses beyond the organisation's legitimate senders. This satisfies the stem's constraint: mail passed SPF yet originated from an unauthorised IP, because that address fell within the record's authorised scope. Tightening the mechanism to `-all` and specific hosts prevents this.

A malicious URL embedded in the email body is a concrete, observable artefact indicating compromise intent, letting analysts block the domain and trace related messages. It qualifies as a host or network-based IOC within email incident triage.

A security intranet portal publishes authoritative advisories that users can revisit, avoiding the risk of a phishing-style email being mistaken for the real alert. It satisfies the stem's requirement for a trusted, verifiable channel during an active phishing incident.

The X-Forefront-Antispam-Report header is inserted by Exchange Online Protection, Microsoft's cloud filtering engine, during mail flow. Its presence confirms the message passed through Microsoft 365's anti-spam and anti-malware pipeline, letting the analyst verify Microsoft's filtering scanned it rather than a third-party gateway.

Mailbox auditing records New-InboxRule and Set-InboxRule events with the rule parameters, actor, and timestamp, and these records persist independently of the Outlook client. Because the attacker can remove the rule from the interface but cannot purge the audit trail, this is the authoritative source for proving the rule existed and identifying the compromised session.

DMARC combines SPF and DKIM results and applies alignment against the visible From domain. A DMARC pass means either SPF or DKIM aligned with the domain in the From header, which directly answers whether the vendor's domain authorized the message. Checking the DMARC result first therefore gives the handler the most reliable indication of sender authorization in this wire-transfer scenario.

Updating the blocklist adds the sender addresses, domains, or subject patterns tied to the resolved campaign, so future messages matching those indicators are filtered automatically. This directly satisfies the stem's requirement of preventing the same campaign from recurring, rather than merely documenting the incident after closure.

Isolating the analysis environment prevents malicious payloads—macros, exploit documents or beaconing malware—from reaching production systems or contacting command-and-control infrastructure. Sandboxing or an air-gapped virtual machine satisfies the stem's safe-practise requirement by containing any execution during inspection, so the analyst can examine headers, attachments and URLs without risking the corporate network.

A URL unshortening service resolves each redirect hop server-side, revealing the final landing page without exposing your own host to the destination. This satisfies the stem's requirement to trace a chain of multiple shortened links safely, since manually following each hop risks drive-by compromise or geolocation-based cloaking.

olevba is a specialized tool for parsing OLE files and extracting VBA macros from Office documents. It can display macro source code, detect suspicious keywords, and identify obfuscation techniques without executing the macro, making it ideal for static analysis in incident response.

Sandboxing detonates suspicious attachments and URLs in an isolated virtual environment, letting analysts observe runtime behaviour such as file writes, registry changes and network callbacks. This satisfies the stem's requirement to safely execute and observe file behaviour, catching zero-day malware that signature-based filtering misses.

Received headers are prepended by each mail transfer agent as the message traverses the path, so their sequence records the actual hops taken; unlike From or Return-Path, they are added by servers rather than supplied by the sender.

A chronological timeline establishes the sequence of events from initial detection through containment and recovery, letting investigators reconstruct what happened and when. It satisfies the reporting requirement for an accurate, ordered account of the incident's progression.

Password-protected archives block gateway inspection because the scanner cannot derive the decryption key, so antivirus and sandbox engines see only ciphertext. This directly satisfies the stem's constraint: the attachment evades content scanning, letting malware reach the user's endpoint unchecked while appearing as a routine compressed file.

Detonating the attachment in an isolated sandbox observes its actual runtime behaviour, such as process creation, registry writes or outbound connections, revealing malicious intent that static signatures miss. This satisfies the stem's requirement for a valid identification method.

SPF, DKIM, and DMARC validate the sending domain, not the display name. A newly registered lookalike domain can publish its own valid SPF, DKIM, and DMARC records, causing all checks to pass for that domain. Because the display name is what users see, the message can pass authentication while still impersonating the CEO, which is the core BEC technique.