Phishing Click Investigation Quiz for Security Analysts

1. During a phishing investigation, you find that the attacker registered a domain using privacy protection. What does this tell you?

The domain is automatically malicious

The attacker likely intended to hide their identity

The domain will expire within 30 days

The website uses SSL encryption

2. A phishing email targeted only employees in the finance department. What type of attack is this most likely?

Whaling attack

Mass phishing campaign

Spear-phishing attack

Business email compromise

3. During a phishing investigation, correlating the click report with proxy logs helps identify which aspect?

The attacker's real identity

Whether the user accessed the malicious site and what happened afterward

The user's email password

The sender's IP address

4. What does the presence of obfuscated JavaScript in a phishing email body suggest?

The email is from a legitimate company

The attacker attempted to evade detection mechanisms

The email uses standard formatting

The recipient's browser is vulnerable

5. After a user clicks a phishing link, which action should be taken immediately to minimize damage?

Delete all emails from that sender

Isolate the affected endpoint and force a password reset

Block the user's email account

Scan the entire network for the phishing domain

6. When investigating a phishing click, what does examining the landing page's SSL certificate reveal?

Whether the attacker purchased a valid certificate for the fake domain

The user's browsing history

The attacker's geographic location

Whether the user entered credentials

7. A phishing email bypassed your email gateway but was flagged by user awareness training. What does this indicate?

The email gateway is not functioning

Your security controls have gaps that user training helps mitigate

The user's email client has superior security

Phishing emails cannot be detected by technology

8. During phishing investigation, which metric helps determine the scope of the incident?

The number of users who clicked the link

The file size of the phishing email

The sender's email domain reputation score

The timestamp of the email's creation

9. What is the primary indicator that a phishing email used a compromised legitimate account rather than a spoofed domain?

The email passed all authentication checks

The email was sent from a known company domain

The email contained HTML formatting

Multiple recipients received the same message

10. A user reports clicking a phishing link at 2:30 PM. When should you check for lateral movement and data exfiltration?

Only after 24 hours have passed

Immediately and continuously over the next 72 hours

Only if the user reports suspicious activity

During the next scheduled vulnerability scan

11. A user reports clicking a phishing email link. Which artifact should you examine first to determine the email's true origin?

Email subject line

Email headers (Return-Path and Received fields)

Sender's display name

Email body formatting

12. What is the primary purpose of analyzing the phishing email's payload and attachments?

To determine the sender's identity

To detect embedded malware or malicious macros

To verify the email's encryption status

To identify the recipient's email client

13. Which log source should you check to confirm whether a user's credentials were actually entered on a phishing site?

Email gateway logs only

Firewall logs and proxy logs

Authentication logs from your identity provider

DNS query logs

14. A user clicked a phishing link and was redirected through multiple URLs before reaching a fake login page. What technique is this?

Domain fronting

URL redirection chain or hop

DNS poisoning

Session hijacking

15. When analyzing a phishing click report, what user behavior pattern suggests a targeted spear-phishing attack?

Multiple users from different departments clicked the same link

Only high-value targets or executives received the email

The email was sent during business hours

The phishing link led to a generic credential harvesting page

16. You discover the phishing email passed SPF and DKIM checks but failed DMARC. What does this indicate?

The email is definitely legitimate

Authentication passed but DMARC policy was not enforced

The sender's domain is compromised

The email never reached the recipient

17. What does the Received header field reveal in an email investigation?

The exact geographic location of the sender

The path the email took through mail servers

Whether the user read the email

The encryption algorithm used

18. After a user clicks a phishing link, which endpoint indicator is most critical to check immediately?

Recently installed applications

Network connections and spawned processes

Browser history

User login timestamps

19. A phishing email claims to be from your bank but contains a link to 'www.b4nk-secure.ru'. What is the primary red flag here?

The domain extension is non-standard

The domain name uses character substitution and a suspicious TLD

Banks never send emails with links

The protocol is HTTP instead of HTTPS

20. When investigating a phishing click, what does a spoofed Return-Path header indicate?

The message was encrypted in transit

The attacker falsified the sender's origin server

The recipient's email client is misconfigured

The message passed SPF validation

Security Analyst Investigating a Phishing Click Report Quiz