Handling and Responding to Email Security Incidents ECIH Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of documenting an email security incident?

   • ATo share the incident details with all employees
   • BTo delete evidence of the incident
   • CTo provide a chronological record for legal and regulatory compliance
   • DTo increase the workload of the incident response team
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   After a phishing attack, the incident response team has identified that the malicious emails are still present in the mailboxes of several users. What is the best way to eradicate the threat?

   • AManually delete the emails from each user's mailbox.
   • BDisable the user accounts and create new ones.
   • CUse a mail flow rule to delete the malicious emails from all mailboxes and purge them from the recoverable items folder.
   • DAsk users to delete the emails themselves.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   After eradicating a ransomware email campaign, you need to restore email services to normal operation. Several users report that their mailboxes are missing emails that were quarantined during the incident. What is the most appropriate recovery action?

   • AAsk users to request resending of the missing emails from senders
   • BRestore the entire mail server from a backup taken before the incident
   • CLeave the emails quarantined and inform users they are permanently lost
   • DRestore the quarantined emails from the email gateway's quarantine store after verifying they are clean
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A denial-of-service attack targeted the email gateway, causing it to crash. The gateway has been patched and restarted, but some emails are stuck in the queue. What is the most appropriate recovery step?

   • AManually forward each stuck email to the recipients.
   • BFlush the email queue and resend the messages from the mail servers.
   • CIgnore the queue and let the emails expire.
   • DReboot the gateway again to clear the queue.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A user receives an email with a URL that appears to be 'https://www.company.com-login.evil.net'. The user is about to click it. What is the best immediate action to prevent credential compromise?

   • AReset the user's password immediately
   • BDelete the email from the user's mailbox
   • CDisable the user's network access
   • DBlock the domain 'evil.net' at the web proxy and email gateway
   Reveal Solution Discussion Select an answer first