Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After eradicating a malware email campaign, you need to restore email services. Some users report that their mailboxes are missing emails that were quarantined during the incident. What is the most appropriate recovery action?

   • ALeave the emails quarantined and inform users they are lost
   • BRestore the mailboxes from a backup taken during the incident
   • CAsk senders to resend the missing emails
   • DRelease the quarantined emails after verifying they are clean
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is investigating an email that claims to be from a bank. The email's headers show that the 'Received' field lists an IP address that is not associated with the bank's domain. What does this indicate?

   • AThe email may have been sent from a different server than the bank's, indicating possible spoofing.
   • BThe email was sent from a mobile device.
   • CThe email is a hoax and contains no threat.
   • DThe email is definitely legitimate because the bank uses multiple servers.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   After identifying a phishing email that has been opened by several users, what is the immediate containment step to prevent further spread?

   • AChange the users' passwords
   • BDisconnect the users' computers from the network
   • CDelete the emails from the users' mailboxes
   • DBlock the sender's address at the email gateway
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is typically performed during the recovery phase of an email security incident?

   • AQuarantining suspicious emails
   • BAnalyzing email headers to trace the origin
   • CRestoring user mailboxes from a clean backup
   • DUpdating firewall rules to block the sender
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A spear-phishing email with a malicious link was sent to the finance team. One user clicked the link and entered their credentials on a fake login page. The user's account has administrative privileges to the financial system. You need to contain the incident. Which action should you take FIRST?

   • ADisable the compromised user's account and reset the password
   • BNotify the finance team to be cautious
   • CRun a full antivirus scan on the user's workstation
   • DBlock the malicious URL at the firewall
   Reveal Solution Discussion Select an answer first