Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   After an email security incident has been contained and eradicated, what is the primary objective of the recovery phase?

   • AIdentify the attacker's identity
   • BBlock the attacker's IP address
   • CRestore email services and data to normal operation
   • DDelete all email logs
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A data breach occurred via a phishing email that led to unauthorized access to customer data. The incident response team has completed the containment and eradication phases. What is the next step in the incident handling process?

   • AConduct a full forensic analysis of the phishing email.
   • BUpdate the incident response plan based on lessons learned.
   • CNotify the relevant regulatory authorities and affected customers as required by law.
   • DRestore all systems from backup.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is a common technique used to hide malicious code inside an email attachment?

   • AChanging the file extension to .txt
   • BEncoding the file in Base64
   • CUsing a password-protected ZIP file
   • DSending the attachment as a PDF
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   An email contains an attachment named 'Invoice_2025.exe'. What type of email-based security incident does this indicate?

   • ASpoofing
   • BBusiness email compromise
   • CPhishing link
   • DMalware attachment
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A user reports receiving an email that appears to be from a colleague, but the email contains an unusual attachment. You need to verify the authenticity of the email. Which header field should you examine first?

   • ADate
   • BReturn-Path
   • CTo
   • DSubject
   Reveal Solution Discussion Select an answer first