A security analyst is reviewing a phishing campaign that targeted three employees in the finance department. The emails were personalized with each employee's name, referenced a recent project, and included a link to a fake document-sharing site. The analyst needs to classify the attack and recommend a mitigation. Which classification and mitigation is most accurate?

Business email compromise; require dual authorization for financial transactions

Spear phishing; implement email filtering rules to block the malicious domain

General phishing; conduct organization-wide security awareness training

Whaling; implement DMARC with a 'reject' policy

A company has a DMARC policy of 'reject' for its domain. An employee receives a phishing email that appears to come from the company's own domain, but the email passes DMARC. The security team is puzzled. Which of the following is the most likely explanation?

The attacker used a lookalike domain that is not covered by DMARC

The email gateway is not enforcing DMARC

The attacker compromised a legitimate mailbox within the company domain

The DMARC record is misconfigured with a policy of 'none'

A finance manager receives an email that appears to be from the company CEO, urgently requesting a wire transfer to a new vendor for a confidential acquisition. The sender domain is a lookalike of the company's domain (e.g., company-name.com instead of company.com). The email passed SPF and DKIM checks because the attacker controls the lookalike domain. Which control would most directly prevent this type of attack from reaching the inbox?

Configure DMARC with a policy of reject for the legitimate domain

Add the attacker's lookalike domain to a blocklist

Train employees to hover over links before clicking

Enable DKIM signing on the company's mail server

Which of the following is a common social engineering lure used in phishing emails?

An attachment that is a PDF with a digital signature

A message that is personalized with the recipient's full name and job title

A sense of urgency, such as 'Your account will be suspended within 24 hours'

A request to update your password using a link that begins with 'https://'

A user clicked a link in a phishing email and entered their credentials on a fake login page. The security team has been notified. What is the most urgent step to contain the incident?

Reset the user's password and revoke active sessions

Run a full antivirus scan on the user's computer

Quarantine the phishing email from the user's mailbox

Block the phishing domain in the email gateway

GIAC Cyber Incident Leader

Domain 1Objective 3

Email Attacks GCIL Practice Questions (Page 3)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 11–15

11expert · medium
A security analyst is reviewing a phishing campaign that targeted three employees in the finance department. The emails were personalized with each employee's name, referenced a recent project, and included a link to a fake document-sharing site. The analyst needs to classify the attack and recommend a mitigation. Which classification and mitigation is most accurate?
Select an answer first
12expert · hard
A company has a DMARC policy of 'reject' for its domain. An employee receives a phishing email that appears to come from the company's own domain, but the email passes DMARC. The security team is puzzled. Which of the following is the most likely explanation?
Select an answer first
13application · medium
A finance manager receives an email that appears to be from the company CEO, urgently requesting a wire transfer to a new vendor for a confidential acquisition. The sender domain is a lookalike of the company's domain (e.g., company-name.com instead of company.com). The email passed SPF and DKIM checks because the attacker controls the lookalike domain. Which control would most directly prevent this type of attack from reaching the inbox?
Select an answer first
14foundation · easy
Which of the following is a common social engineering lure used in phishing emails?
Select an answer first
15expert · medium
A user clicked a link in a phishing email and entered their credentials on a fake login page. The security team has been notified. What is the most urgent step to contain the incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Email Attacks GCIL Practice Questions (Page 3)

Questions 11–15

A company has a DMARC policy of 'reject' for its domain. An employee receives a phishing email that appears to come from the company's own domain, but the email passes DMARC. The security team is puzzled. Which of the following is the most likely explanation?

Which of the following is a common social engineering lure used in phishing emails?

A user clicked a link in a phishing email and entered their credentials on a fake login page. The security team has been notified. What is the most urgent step to contain the incident?

Keep studying — Attack Types and Vectors