Phishing Response for Infrastructure Specialists

1. Which security control best detects phishing emails before they reach users?

Firewall rules

Email filtering with threat intelligence

VPN encryption

Password policies

2. What is the purpose of blocking the sender's domain in your email gateway after a phishing attack?

Prevent future emails from that domain

Contain the threat and stop additional attacks

Permanently delete user accounts

Notify law enforcement automatically

3. After containing a phishing incident, what documentation should you maintain?

Email content only

Indicators of compromise, timeline, affected users, and remediation steps

User names and passwords

No documentation needed

4. Which CompTIA Security+ domain primarily covers incident response procedures?

Risk Management

Cryptography and PKI

Incident Response and Recovery

Network Security

5. A phishing email uses a shortened URL (bit.ly link). Why is this a security concern?

It saves bandwidth

It masks the true destination and hides the malicious URL

It requires authentication

It improves email delivery

6. What is OSINT in the context of phishing investigation?

Open-source intelligence gathering about the attack

Operating system integrity testing

Offline security information transfer

Organizational security information network

7. Which incident response phase occurs immediately after a phishing report is confirmed?

Recovery

Preparation

Containment

Lessons learned

8. An email requests urgent payment to a new vendor account. What red flag should trigger phishing suspicion?

The email uses formal language

Unusual requests for payment changes or urgent action

The sender is in the finance department

The email is encrypted

9. What should you do if a phishing email appears to come from an internal company address?

Assume it is legitimate

Investigate account compromise and check email logs

Forward to the supposed sender

Ignore it

10. Whaling attacks specifically target which group within an organization?

IT support staff

New employees

Senior executives and decision-makers

Contractors

11. When a user reports a suspected phishing email, what should be your first action?

Immediately delete the email from all systems

Isolate the affected user's account and preserve the email for analysis

Forward it to all staff as a security awareness example

Request the user's password to verify account compromise

12. A user reports entering their credentials into a phishing site. What is the immediate remediation step?

Monitor the account for suspicious activity

Force password reset and review account activity logs

Delete the user account

Disable email only

13. What is the most effective way to prevent users from clicking phishing links?

Disable all email links

Regular security awareness training and simulated phishing exercises

Monitor all user clicks manually

Remove user internet access

14. When should you notify your organization's leadership about a phishing incident?

Only after full investigation is complete

Immediately if credentials or sensitive data may be compromised

Never—handle it internally

Only if more than 100 users are affected

15. A phishing email contains a link to 'www.bankofamerica-secure.com'. What is the primary security concern?

The domain uses HTTPS

Domain spoofing—URL mimics legitimate bank but differs

The link contains special characters

The email includes a timestamp

16. Which tool would you use to safely analyze a suspicious email attachment without exposing your network?

Open it directly on your workstation

Isolated sandbox environment

Forward to the sender for verification

Upload to shared network drive

17. If multiple users report phishing emails with identical content, what incident classification applies?

Single user compromise

Widespread phishing campaign

Internal security breach

Network misconfiguration

18. What is the primary purpose of implementing email authentication protocols like DKIM and SPF?

Encrypt email content

Verify sender identity and prevent domain spoofing

Block all external emails

Log all user email activity

19. A phishing email claims to be from your bank and requests immediate password reset. This is an example of which attack type?

Spear phishing

Whaling

Generic phishing

Business email compromise

20. Which email header field is most critical for tracing the true origin of a phishing email?

From

Return-Path and Received headers

Subject

CC

Infrastructure Specialist Responding to a Phishing Report Quiz