Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which containment strategy is most appropriate when a malware attachment has been opened on a user's workstation?

   • AIsolate the workstation from the network
   • BChange the user's password
   • CRun a full antivirus scan
   • DRestore the system from backup
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You receive an email that passes SPF and DKIM checks, but the DMARC policy is 'none'. The email contains a link to a website that asks for a password. The sender domain is similar to your company's domain but with a typo (e.g., 'company.com' vs 'cornpany.com'). How should you classify this email?

   • APhishing attempt using a lookalike domain
   • BLegitimate email from a trusted source
   • CBusiness email compromise
   • DSpam email
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A user reports receiving an email that appears to be from the company CEO, requesting an urgent wire transfer. The email's Reply-To address is an external domain, and the display name is spoofed. You need to determine if the email is genuinely from the CEO. Which action provides the most reliable evidence?

   • ACheck the email headers for the Return-Path and Received chain
   • BLook at the display name and signature in the email
   • CCheck if the email was sent during business hours
   • DCompare the email's language and tone with previous CEO emails
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An employee receives an email with a PDF attachment that, when opened, triggers a PowerShell script that downloads additional malware. The malware has already executed on the employee's workstation. What is the immediate containment step?

   • ADisconnect the workstation from the network and disable the user's email account.
   • BForward the email to the security team for analysis without any other action.
   • CDelete the email from the user's mailbox and run a full antivirus scan.
   • DReboot the workstation to clear the malware from memory.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After a phishing campaign, you have identified that a malicious attachment was delivered to 50 users. You have already blocked the attachment hash at the gateway. What is the next eradication step?

   • ASearch all mailboxes for the attachment and delete the emails
   • BNotify users to delete the emails themselves
   • CRestore the mailboxes from backup
   • DRun a vulnerability scan on the mail server
   Reveal Solution Discussion Select an answer first