During an incident, a security analyst needs to determine whether a suspicious email was actually sent from the company's own mail server or from an external source spoofing the domain. Which step is most appropriate to perform first?

Quarantine the email and all replies

Preserve the email as evidence using a forensic image

Block the sender's IP address at the firewall

Analyze the email headers, including the Received and Authentication-Results fields

In a phishing email, what is the primary purpose of embedding a deceptive link?

To increase the sender's email reputation score

To verify the recipient's email address is active

To direct the victim to a malicious website that harvests credentials or delivers malware

To encrypt the email content in transit

What is the primary goal of a business email compromise (BEC) attack?

To steal personal information for identity theft

To gain access to the victim's email account for future attacks

To trick the victim into making an unauthorized financial transfer or payment

To install ransomware on the victim's computer

A user reports that they received an email with a PDF attachment that, when opened, displayed a message saying 'Enable macros to view this document.' The user did not enable macros and reported the email. The security team analyzes the PDF and finds it contains an embedded script. What is the most likely intent of this email?

Conduct a spear phishing campaign

Phish for credentials via a deceptive link

Deliver malware via a malicious attachment

GIAC Cyber Incident Leader

Domain 1Objective 3

Email Attacks GCIL Practice Questions (Page 10)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 46–50

46application · medium
During an incident, a security analyst needs to determine whether a suspicious email was actually sent from the company's own mail server or from an external source spoofing the domain. Which step is most appropriate to perform first?
Select an answer first
47foundation · easy
In a phishing email, what is the primary purpose of embedding a deceptive link?
Select an answer first
48foundation · easy
What is the primary goal of a business email compromise (BEC) attack?
Select an answer first
49foundation · easy
Which type of malware is commonly delivered via email attachments and is designed to encrypt files and demand a ransom?
Select an answer first
50expert · medium
A user reports that they received an email with a PDF attachment that, when opened, displayed a message saying 'Enable macros to view this document.' The user did not enable macros and reported the email. The security team analyzes the PDF and finds it contains an embedded script. What is the most likely intent of this email?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Email Attacks GCIL Practice Questions (Page 10)

Questions 46–50

During an incident, a security analyst needs to determine whether a suspicious email was actually sent from the company's own mail server or from an external source spoofing the domain. Which step is most appropriate to perform first?

In a phishing email, what is the primary purpose of embedding a deceptive link?

What is the primary goal of a business email compromise (BEC) attack?

Which type of malware is commonly delivered via email attachments and is designed to encrypt files and demand a ransom?

Keep studying — Attack Types and Vectors