Email Attacks GCIL Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a best practice for reducing user susceptibility to email attacks?

   • AInstructing users to forward suspicious emails to all colleagues to warn them
   • BRequiring users to open attachments to check if they are safe
   • CTraining users to verify unusual requests through a secondary communication channel, such as a phone call
   • DEncouraging users to click links in emails to verify their legitimacy
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A finance manager receives an email that appears to be from the company's CEO, urgently requesting a wire transfer to a new vendor for a confidential acquisition. The sender's address is a lookalike domain (e.g., ceo@company-name.com instead of ceo@company.com). The manager is about to act. What is the most immediate and effective action to verify the request?

   • AReply to the email asking the CEO to confirm the request
   • BVerify the request by calling the CEO using a known phone number from the corporate directory
   • CForward the email to the IT help desk for analysis
   • DCheck the email headers to see if SPF and DKIM passed
   Reveal Solution Discussion Select an answer first
4. 33application · easy

   A cybersecurity trainer is explaining the difference between phishing and spear phishing to a new hire. Which example best illustrates spear phishing?

   • AAn email that appears to be from a shipping company, sent to many customers, asking them to track a package
   • BA mass email claiming to be from a bank, sent to thousands of random addresses, asking recipients to update their account information
   • CAn email sent to the company's CFO, referencing a recent conference she attended and including a link to a fake presentation download
   • DAn email with a malicious attachment sent to a generic distribution list of all employees
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has been a victim of BEC where the attacker impersonated a vendor and requested payment to a new bank account. The email was sent from a lookalike domain. The company wants to prevent this from happening again. Which control is most effective?

   • ATrain employees to check the sender's email address carefully
   • BBlock all emails from lookalike domains
   • CImplement DMARC with a 'reject' policy for the vendor's domain
   • DImplement a financial verification process that requires out-of-band confirmation for any change in payment details
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which email attack vector is most likely to target a high-level executive such as a CEO or CFO with a personalized message?

   • APharming
   • BVishing
   • CSmishing
   • DWhaling
   Reveal Solution Discussion Select an answer first