What is the primary purpose of SPF (Sender Policy Framework) in email authentication?

To verify that the sending mail server is authorized to send email for the domain

To provide a policy for how receiving servers should handle failed authentication checks

To encrypt the content of email messages in transit

To digitally sign email messages to prove the sender's identity

An organization is planning to implement DMARC. They have a complex email environment with multiple third-party services sending email on behalf of their domain. They want to avoid legitimate emails being rejected. What is the recommended approach?

Use a 'quarantine' policy permanently to avoid any risk of rejection

Only implement SPF and DKIM without DMARC

Immediately implement a 'reject' policy to maximize protection

Start with a DMARC policy of 'none', analyze reports, then move to 'quarantine' and eventually 'reject'

A company's email gateway is configured to block executable attachments, but a user still received a malicious .docm file that downloaded ransomware. The security team wants to improve protection against such macro-based attacks. Which control would be most effective?

Disable macros in Office applications via Group Policy

Configure the email gateway to block all macro-enabled Office files

Increase the frequency of antivirus signature updates

Train users to avoid opening attachments from unknown senders

A security analyst is investigating an email that appears to be from the company's CEO. The email passed SPF and DKIM, but the 'From' header displays the CEO's name and the company's domain. The analyst notices that the 'Return-Path' domain is different from the 'From' domain. The company's DMARC policy is set to quarantine. Why did the email pass authentication and reach the inbox?

The email was sent from an internal server, bypassing DMARC

DKIM signature was valid and aligned, so DMARC passed

DMARC alignment is relaxed, so the SPF-passing Return-Path domain aligns with the From domain

The DMARC policy of quarantine only applies to messages with attachments

A user receives an email that appears to be a shipping notification with a ZIP attachment. The user opens the attachment, which launches a PowerShell script that downloads and executes ransomware. Which email attack vector and technique combination is this?

Spear phishing with a deceptive link

Business email compromise via invoice fraud

Malware delivery via a malicious attachment using a social engineering lure

Whaling targeting a senior executive

GIAC Cyber Incident Leader

Domain 1Objective 3

Email Attacks GCIL Practice Questions (Page 2)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 6–10

6foundation · easy
What is the primary purpose of SPF (Sender Policy Framework) in email authentication?
Select an answer first
7expert · hard
An organization is planning to implement DMARC. They have a complex email environment with multiple third-party services sending email on behalf of their domain. They want to avoid legitimate emails being rejected. What is the recommended approach?
Select an answer first
8expert · hard
A company's email gateway is configured to block executable attachments, but a user still received a malicious .docm file that downloaded ransomware. The security team wants to improve protection against such macro-based attacks. Which control would be most effective?
Select an answer first
9expert · hard
A security analyst is investigating an email that appears to be from the company's CEO. The email passed SPF and DKIM, but the 'From' header displays the CEO's name and the company's domain. The analyst notices that the 'Return-Path' domain is different from the 'From' domain. The company's DMARC policy is set to quarantine. Why did the email pass authentication and reach the inbox?
Select an answer first
10application · medium
A user receives an email that appears to be a shipping notification with a ZIP attachment. The user opens the attachment, which launches a PowerShell script that downloads and executes ransomware. Which email attack vector and technique combination is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.