Email Monitoring

Question 1

Spear Phishing

Answer 1

An email spoofing attack targeting a specific organization or individual by
seeking unauthorized access to sensitive information

Question 2

BEC

Answer 2

An impersonation attack in which the attacker gains control of an
employee’s account and uses it to convince other employees to perform
fraudulent actions

Question 3

Forwarding

Answer 3

When a phishing email is formatted to appear as if it has come as part of
a reply or forward chain

Question 4

Email Internet Header

Answer 4

A record of the email servers involved in transferring an email message
from a sender to a recipient
Exploit 3 address fields in email
Display From Support@diontraining.com theft@badguy.com
Envelope From Various labels hidden from mail client
Received From/By List of the MTAs that processed email

Question 5

Email Server Security

Answer 5

Spoofing attacks can be mitigated by configuring authentication for email server
systems. SPF, DKIM, and DMARC do not solve the problem of cousin domains

Question 6

SPF

Answer 6

DNS record identifying hosts authorized to send mail for the domain with
only one being allowed per domain

Question 7

DKIM

Answer 7

Provides a cryptographic authentication mechanism for mail utilizing a
public key published as a DNS record

Question 8

DMARC

Answer 8

A framework for ensuring proper application of SPF and DKIM utilizing a
policy published as a DNS record

Question 9

SMTP Log analysis codes

Answer 9

Code 220 indicates the server is ready
Code 250 indicates the message is accepted
Code 421 indicates the service is not available
Code 450 indicates that the server cannot access the mailbox to deliver a
message
Code 451 indicates the local server aborted the action due to a
processing error
Code 452 indicates the local server has insufficient storage space
available

Question 10

S/MIME

Answer 10

An email encryption standard that adds digital signatures and public key
cryptography to traditional MIME communications

Question 11

Email Content Analysis

Answer 11

An attacker must also craft some sort of payload to complete the exploit when a
victim opens a message

Question 12

MIME

Answer 12

Allows a body of an email to support different formats, such as HTML,
rich text format (RTF), binary data encoded as Base64 ASCII characters,
and attachments