Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An email has a suspicious attachment that is a .docm file. The email's headers show that it originated from an external IP address that is known to be malicious. What is the most appropriate classification?

   • AMalware attachment email from a malicious source.
   • BPhishing email with a spoofed sender.
   • CSpam email that should be filtered.
   • DA legitimate email that was misrouted.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A business email compromise (BEC) incident resulted in a fraudulent wire transfer. The incident response team has contained the incident and is now preparing the incident report. What is the most critical element to include in the report?

   • AThe names of the employees who opened the phishing email.
   • BThe cost of the incident response efforts.
   • CThe full email headers and the exact timeline of the incident.
   • DThe recommended security awareness training for all employees.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action is part of the eradication phase for an email security incident?

   • ARestoring user mailboxes from backup
   • BPatching the vulnerability that allowed the malware to execute
   • CMonitoring network traffic for indicators of compromise
   • DConducting a lessons-learned meeting
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   You are analyzing a suspicious email. The SPF check passes, but the DKIM signature fails, and the DMARC policy is set to 'quarantine'. The email's From header shows the CEO's address, but the Return-Path is an external domain. What is the most likely explanation?

   • AThe email is from the CEO's actual account, but the Return-Path was altered in transit
   • BThe email is spoofed, and the SPF pass is due to the Return-Path domain being authorized, not the From domain
   • CThe email is legitimate, and the DMARC quarantine is a false positive
   • DThe email is legitimate, and the DKIM failure is a temporary server issue
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An email contains an attachment that is a .js file. The email's content urges the user to open the attachment to view an invoice. What is the most likely threat?

   • AA phishing link embedded in the attachment.
   • BA harmless script that is commonly used for invoices.
   • CA spoofed email that contains no actual threat.
   • DMalicious script that could execute arbitrary code on the user's machine.
   Reveal Solution Discussion Select an answer first