A user reports a suspicious email. How would you analyse it?

What the interviewer wants to hear

• Check sender, reply-to and authentication results (SPF, DKIM, DMARC)
• Inspect links and attachments safely without clicking or opening
• Check indicators against threat intelligence and sandbox
• Search for other recipients and anyone who clicked
• Remove the email, block indicators and inform the user

Model answer

First I look at the full headers: the real sender, the Return-Path and Reply-To, the sending IP and the Authentication-Results for SPF, DKIM and DMARC. A lookalike domain or a failed DMARC check is a strong red flag. Next I check the content for urgency or payment requests. I never click links; I extract URLs and attachment hashes and check them in tools like VirusTotal or URLScan, and detonate attachments in a sandbox if needed. If it is malicious, I search the mail gateway for the same sender, subject or URL to find all recipients, pull the emails from mailboxes, and check proxy and EDR logs for anyone who clicked or opened it. Then I block the domain, URLs and hashes, reset credentials for anyone who entered them, and thank the user for reporting.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?