A security team is configuring email authentication for a domain that uses a third-party email marketing service. The marketing service sends emails on behalf of the domain, but the SPF record currently includes the marketing service's IPs. The team wants to implement DMARC with a reject policy. What is the most important consideration to avoid legitimate marketing emails being rejected?

Set the DMARC policy to none initially to monitor

Configure the marketing service to send from a subdomain

Ensure that the marketing service's emails pass DKIM and are aligned with the From domain

Add the marketing service's domain to the SPF record

A security analyst is investigating a phishing email that passed the company's email gateway. The email claims to be from a well-known shipping company and includes a link to a credential-harvesting page. The analyst checks the authentication results and sees that SPF passed, DKIM passed, but DMARC policy is 'none'. What does this combination indicate?

The email could still be spoofed because DMARC policy 'none' means no enforcement, and the visible 'From' domain may not be covered by the passing SPF/DKIM

The email is definitely malicious because DMARC policy 'none' is a sign of misconfiguration

The email is spoofed because DMARC policy is 'none'

The email is legitimate because SPF and DKIM both passed

How can email be used to deliver spyware?

By sending an attachment that, when opened, installs software that monitors the user's keystrokes and screen activity

By sending an email that deletes system files without user interaction

By sending an email that automatically changes the recipient's DNS settings

By using a phishing link to redirect the user to a website that displays pop-up ads

A CFO receives an email from the CEO's personal email address (ceo@gmail.com) asking for a list of employee W-2 forms to be emailed back. The CEO's corporate email is known to be ceo@company.com. Which type of email attack is this?

Business email compromise (BEC)

A company has a mature security awareness program with regular phishing simulations. Despite this, a BEC attack succeeded because an employee responded to a fraudulent invoice email and initiated a wire transfer. The email was sent from a compromised vendor account and contained no malicious links or attachments. Which additional control would be most effective in preventing this specific type of loss?

Implement a financial verification process for payment changes, such as out-of-band confirmation

Deploy an email gateway that blocks lookalike domains

Increase the frequency of phishing simulations

Require multi-factor authentication for all vendor accounts

GIAC Cyber Incident Leader

Domain 1Objective 3

Email Attacks GCIL Practice Questions (Page 5)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 21–25

21expert · hard
A security team is configuring email authentication for a domain that uses a third-party email marketing service. The marketing service sends emails on behalf of the domain, but the SPF record currently includes the marketing service's IPs. The team wants to implement DMARC with a reject policy. What is the most important consideration to avoid legitimate marketing emails being rejected?
Select an answer first
22application · medium
A security analyst is investigating a phishing email that passed the company's email gateway. The email claims to be from a well-known shipping company and includes a link to a credential-harvesting page. The analyst checks the authentication results and sees that SPF passed, DKIM passed, but DMARC policy is 'none'. What does this combination indicate?
Select an answer first
23foundation · easy
How can email be used to deliver spyware?
Select an answer first
24application · medium
A CFO receives an email from the CEO's personal email address (ceo@gmail.com) asking for a list of employee W-2 forms to be emailed back. The CEO's corporate email is known to be ceo@company.com. Which type of email attack is this?
Select an answer first
25expert · hard
A company has a mature security awareness program with regular phishing simulations. Despite this, a BEC attack succeeded because an employee responded to a fraudulent invoice email and initiated a wire transfer. The email was sent from a compromised vendor account and contained no malicious links or attachments. Which additional control would be most effective in preventing this specific type of loss?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Email Attacks GCIL Practice Questions (Page 5)

Questions 21–25

How can email be used to deliver spyware?

A CFO receives an email from the CEO's personal email address (ceo@gmail.com) asking for a list of employee W-2 forms to be emailed back. The CEO's corporate email is known to be ceo@company.com. Which type of email attack is this?

Keep studying — Attack Types and Vectors