Email Attacks GCIL Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is domain impersonation in the context of email attacks?

   • AUsing a subdomain of a legitimate domain to send emails
   • BRegistering a domain that is exactly the same as a legitimate domain but with a different TLD
   • CUsing a domain name that is visually similar to a legitimate domain, such as 'rnicrosoft.com' instead of 'microsoft.com'
   • DSending an email from a compromised account within the legitimate domain
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a key step in containing an email-based malware attack?

   • ADisconnecting affected systems from the network to prevent malware spread
   • BRunning a full antivirus scan on the mail server
   • CDeleting the malicious email from the user's inbox without further action
   • DImmediately sending a company-wide email warning about the attack
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A user receives an email that appears to be from a package delivery service, stating that a delivery attempt was made and asking the user to click a link to reschedule. The link goes to a website that looks legitimate but is not the real delivery service. The user does not click the link and reports it. What is the primary phishing technique used in this email?

   • AInvoice fraud
   • BDeceptive link
   • CCEO fraud
   • DMalicious attachment
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A user reports that they clicked a link in a phishing email and entered their credentials on a fake login page. The security team needs to contain the incident. Which action should be taken first?

   • AQuarantine the email from all users
   • BBlock the phishing domain at the firewall
   • CForce a password reset for the affected user and revoke active sessions
   • DAnalyze the email headers to determine the sender
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has experienced a BEC attack where the attacker impersonated the CEO and requested a wire transfer. The email passed SPF and DKIM because the attacker had compromised the CEO's account. The company wants to reduce the risk of future BEC attacks. Which combination of controls would be most effective?

   • AIncrease the frequency of password changes
   • BImplement multi-factor authentication (MFA) and train employees to verify financial requests via a secondary channel
   • CBlock all external emails with attachments
   • DStrengthen the DMARC policy to 'reject'
   Reveal Solution Discussion Select an answer first