Email Incidents

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

Which action should be taken after an email incident is contained and the indicators are identified?

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

When DKIM signature verification fails, what is the most likely technical cause?

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

Which TWO of the following steps are required when performing a post-mortem analysis of an email incident?

Which THREE of the following email security technologies should be configured to prevent domain spoofing?

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

Which TWO of the following describe the role of an email gateway in incident response?

An employee receives a suspicious email asking to verify account details by clicking a link. What is the most effective user behavior to mitigate this?

Which THREE of the following are common indicators of a phishing email?

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

Which THREE of the following could be considered 'indicators of compromise' (IOCs) for an email incident?

Which THREE of the following are appropriate communication channels to keep users informed during an email phishing incident?

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

When an email incident is resolved, why is it necessary to update the organization's blocklist?

Which TWO of the following are safe practices when analyzing a suspicious email?

You are analyzing an email and the URL redirects through multiple shortened link services. What is the recommended way to find the final landing page?

What is the purpose of 'Sandboxing' in email security?

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

Which THREE of the following items should be included in an email incident report?

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

Which TWO of the following are valid methods to identify a malicious attachment?