Email Attacks GCIL Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A company wants to improve its users' ability to recognize and report email attacks. They have a limited budget and need to choose a single most effective measure. Which measure should they implement?

   • ADisable all external email
   • BPost posters in the break room about phishing
   • CConduct regular phishing simulations with immediate feedback
   • DRequire users to change passwords every 60 days
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company's security team is configuring email authentication. They have already published an SPF record that includes all legitimate sending IPs. They want to prevent attackers from spoofing their domain in emails sent to external recipients. Which additional configuration is required to achieve this?

   • APublish a DMARC record with a policy of reject
   • BConfigure the mail server to add a 'X-Originating-IP' header
   • CCreate an allowlist of external domains
   • DAdd a DKIM signature to all outgoing mail
   Reveal Solution Discussion Select an answer first
3. 53expert · hard

   During an incident, a security analyst discovers that a phishing email with a malicious attachment was delivered to multiple users. The email passed SPF and DKIM because the attacker compromised a legitimate email account within the company. Which containment action is most effective in preventing further spread of the malware?

   • ADisable the compromised account and revoke its access tokens
   • BDelete the email from all user mailboxes
   • CRun an antivirus scan on all endpoints
   • DBlock the attachment hash at the email gateway
   Reveal Solution Discussion Select an answer first