Email and Web Browser Protections GCCC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user receives an email with a PDF attachment that appears to be an invoice from a known vendor. The email gateway's reputation filter scores the sender as neutral, but the attachment has never been seen before. The security team wants to prevent malware execution while minimizing disruption to legitimate business. What should the team configure?

   • AIncrease the sender reputation score threshold to reject more messages
   • BDeliver the email and rely on the user's antivirus to detect the attachment
   • CBlock all PDF attachments from external senders
   • DEnable sandboxing for all email attachments with detonation in a virtual environment
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During the eradication phase of an email incident, what is the primary goal?

   • ATo identify the root cause of the incident
   • BTo restore systems to normal operation
   • CTo remove the malicious email, attachments, and any associated malware from the environment
   • DTo communicate with stakeholders
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization wants to protect users from drive-by downloads when they visit compromised websites. They have already deployed a web filter that blocks known malicious domains. Which additional browser-level control should they enable to catch new or unknown malicious sites?

   • AConfigure the browser to always open downloads in a sandboxed environment.
   • BEnable the browser's safe browsing feature, which checks URLs against real-time lists of unsafe sites.
   • CSet the browser to block all third-party cookies.
   • DDisable JavaScript in the browser for all websites.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company's email domain has SPF, DKIM, and DMARC configured with a policy of p=quarantine. The security team wants to move to p=reject to reduce spoofing, but they are concerned about legitimate emails being rejected. They have been monitoring DMARC reports for two months and see that 5% of legitimate emails fail authentication because a third-party marketing service sends emails on behalf of the company and is not included in SPF or DKIM. What should the team do before changing the policy to p=reject?

   • AChange the DMARC policy to p=reject immediately and monitor for false positives.
   • BUpdate the SPF record to include the marketing service's sending IPs and ensure the service signs emails with DKIM.
   • CSet the DMARC policy to p=none and continue monitoring reports.
   • DAsk the marketing service to send emails from a different domain.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After a phishing simulation, 15% of employees clicked a link in a fake email that appeared to come from the CEO. The email used the CEO's name and signature but a slightly misspelled domain. Which follow-up action would most effectively reduce the success of similar attacks?

   • ASend a company-wide email warning employees about phishing in general.
   • BBlock all emails that contain the CEO's name in the display name.
   • CConduct targeted training for the employees who clicked, focusing on checking the sender domain and verifying unusual requests.
   • DIncrease the frequency of phishing simulations to weekly.
   Reveal Solution Discussion Select an answer first