Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing an email that has a suspicious link. The email's headers show that the SPF and DKIM checks failed. What is the most likely classification of this email?

   • AA malware attachment email that bypassed the gateway.
   • BA legitimate email that was misconfigured by the sender's IT team.
   • CPhishing email with a spoofed sender domain.
   • DA hoax email that contains no actual threat.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has experienced a spear-phishing attack that targeted the HR department, resulting in the exposure of employee PII. The incident response team has contained the incident and is preparing the incident report. The company's legal team requires that the report include enough detail to support potential legal action, but the company's public relations team wants to minimize the information disclosed to the public. What is the best approach?

   • ADelay the report until the investigation is complete and the attacker is identified.
   • BOnly report the incident to regulators and do not inform the affected employees.
   • CPrepare a detailed internal report for legal and regulatory purposes, and a separate public statement with limited information.
   • DInclude all details in the public statement to be transparent.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following should be included in an email security incident report?

   • AThe incident timeline, affected systems, and actions taken
   • BThe passwords of affected users
   • COnly the final outcome of the incident
   • DThe personal opinions of the incident handler
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which email authentication standard uses a digital signature to verify the sender's domain and detect spoofing?

   • ADKIM
   • BTLS
   • CDMARC
   • DSPF
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A ransomware attack encrypted email databases and the mail server is now restored from a clean backup. Users are able to log in, but some mailboxes are missing recent emails. What is the most appropriate recovery action?

   • ADeclare the incident closed since the server is operational.
   • BReimage the mail server and reinstall the operating system.
   • CAsk users to recreate the missing emails manually.
   • DRestore the missing emails from the last known-good backup and verify the integrity of the restored data.
   Reveal Solution Discussion Select an answer first