ISC2 CC Security Operations Practice Question
Which TWO of the following are common indicators of a phishing email?
⚠ Common exam trap
The trap is selecting options that seem 'suspicious' in general (like attachments or full-name greetings) without recognizing that phishing indicators must be specific anomalies — attachments and personalization are common in legitimate email, so only the unexpected sender and urgency are reliable indicators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unexpected sender or email address
Option D is correct because phishing emails frequently originate from spoofed or look-alike domains that the recipient does not recognize, so an unexpected sender or mismatched email address is a classic red flag. Option E is correct because attackers rely on social engineering that creates urgency—phrases like "act now" or "your account will be closed"—to pressure victims into clicking links or disclosing credentials before they scrutinize the message. In contrast, option A is not an indicator since professional formatting and correct grammar are typical of legitimate email and, if anything, poor grammar is the more common phishing clue. Option B is not reliable because legitimate business email routinely carries attachments, so an attachment alone proves nothing. Option C is likewise not an indicator, as using the recipient's full name is normal, personalized behavior in genuine correspondence and does not by itself signal phishing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Professional formatting with correct grammar
Why it's wrong here
Polished, grammatical formatting is typical of legitimate corporate mail, so it signals nothing malicious. It is tempting because poor spelling is a classic phishing tell, yet attackers increasingly copy professional templates; correct grammar would be the right indicator of a genuine message, not a phishing one.
- ✗
Presence of a file attachment
Why it's wrong here
Attachments are routine in ordinary business correspondence, so their mere presence indicates nothing about intent. It is tempting because malicious payloads often arrive attached, but detection depends on file type and sender reputation; an attachment would be the correct indicator only when paired with an unexpected or executable file.
- ✗
Use of the recipient's full name in the greeting
Why it's wrong here
Personalised greetings are easily harvested from breached databases and social media, so using the recipient's name proves no legitimacy. It is tempting because generic salutations were once a phishing hallmark, but mass-mailing tools now merge names automatically; a full name would be the correct indicator of a legitimate, targeted communication.
- ✓
Unexpected sender or email address
Why this is correct
A sender address that does not match the purported organisation, or arrives unexpectedly, indicates spoofing or domain impersonation. This satisfies the stem's indicator criterion because legitimate correspondence normally originates from a recognisable, expected address, making the mismatch a reliable phishing signal.
- ✓
Urgent language requesting immediate action
Why this is correct
Pressure to act immediately, such as threats of account suspension or deadlines, is a social-engineering tactic that suppresses scrutiny. This satisfies the stem's indicator criterion because urgency is engineered to push recipients into clicking links or disclosing credentials before verifying the sender's legitimacy.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
Key term
Social engineering
Social engineering is the psychological manipulation of people into divulging confidential information or performing actions that compromise security.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.