Which of the following is a common method used in business email compromise (BEC) attacks?

Using a keylogger to capture the victim's email password

Impersonating a vendor and requesting payment to a new bank account

Sending a mass email with a malicious link to a fake login page

Exploiting a vulnerability in the email server software

What is the role of DMARC (Domain-based Message Authentication, Reporting, and Conformance) in email security?

To allow domain owners to specify how receivers should handle emails that fail SPF or DKIM checks

To block all emails from domains that do not have a DMARC record

To encrypt email messages end-to-end

To replace SPF and DKIM with a single authentication method

What is the first step in the incident response process for a reported email attack?

Confirm and triage the report to determine the scope and severity of the incident

Preserve the email as evidence by taking a forensic image of the mail server

Quarantine the suspicious email to prevent further spread

Analyze the email headers to identify the source and path of the email

A company has experienced a BEC attack where an attacker impersonated the CFO and requested a wire transfer. The email was sent from a lookalike domain that passed SPF and DKIM. The company has DMARC with a policy of reject. Why did the email still reach the CFO's assistant?

The attacker used a compromised account within the company

The DMARC record is not published at the correct DNS host or uses an invalid syntax

The email was sent as a reply to a previous legitimate email

The assistant's email client does not support DMARC

A user reports receiving a suspicious email with a link that appears to go to a known software vendor's site, but the URL is slightly misspelled. The user did not click the link. What is the first step in the incident response process for this email attack?

Run an antivirus scan on the user's computer

Delete the email from the user's mailbox immediately

Quarantine the email and preserve it as evidence

Block the sender's email address in the gateway

GIAC Cyber Incident Leader

Domain 1Objective 3

Email Attacks GCIL Practice Questions (Page 9)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 41–45

41foundation · easy
Which of the following is a common method used in business email compromise (BEC) attacks?
Select an answer first
42foundation · easy
What is the role of DMARC (Domain-based Message Authentication, Reporting, and Conformance) in email security?
Select an answer first
43foundation · easy
What is the first step in the incident response process for a reported email attack?
Select an answer first
44expert · hard
A company has experienced a BEC attack where an attacker impersonated the CFO and requested a wire transfer. The email was sent from a lookalike domain that passed SPF and DKIM. The company has DMARC with a policy of reject. Why did the email still reach the CFO's assistant?
Select an answer first
45application · medium
A user reports receiving a suspicious email with a link that appears to go to a known software vendor's site, but the URL is slightly misspelled. The user did not click the link. What is the first step in the incident response process for this email attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.