Cybersecurity Analyst
Phishing and email security questions
109 questions on Phishing and email security for cybersecurity analysts, easiest first.
Easy 34
- Where to see SPF, DKIM and DMARC resultseasy
- What is spear phishing?easy
- What does SPF check?easy
- Spot the social engineeringeasy
- What whaling meanseasy
- Phishing by text messageeasy
- Phishing over a phone calleasy
- QR code in a phishing emaileasy
- Name looks right, address does noteasy
- Checking a link before clickingeasy
- Why phishing creates urgencyeasy
- User spots a phishing emaileasy
- Why analysts write hxxpeasy
- Reply goes somewhere elseeasy
- Boss wants gift cardseasy
- A copy of a real emaileasy
- Order of Received headerseasy
- Two different sender addresseseasy
- Why phones are riskiereasy
- A believable cover storyeasy
- USB drive in the car parkeasy
- Following someone through the dooreasy
- Free help in exchange for accesseasy
- Enter PIN to receive moneyeasy
- KYC expiry messageeasy
- invoice.pdf.exeeasy
- What BEC meanseasy
- Why run phishing simulationseasy
- Password manager stays silenteasy
- The [EXTERNAL] tageasy
- An attachment that is a login pageeasy
- The CEO's voice on the phoneeasy
- Which simulation metric matterseasy
- Infecting a site victims visiteasy
Medium 44
- Suspicious process tree in EDRmedium
- What DMARC p=none doesmedium
- Spot the lookalike sender domainmedium
- Caller asks the helpdesk to reset MFAmedium
- What a passing DKIM check provesmedium
- SPF ~all versus -allmedium
- SPF record suddenly failsmedium
- DMARC rua and rufmedium
- Domain starting with xn--medium
- URL with an @ signmedium
- Which domain owns this link?medium
- Trusted domain, bad destinationmedium
- HTML attachment drops a ZIPmedium
- Password in the email bodymedium
- Domain registered yesterdaymedium
- Macros blocked in a downloaded filemedium
- Link was clean at deliverymedium
- Sandbox says clean, user got infectedmedium
- Purpose of ARC headersmedium
- Getting a logo in Gmailmedium
- DMARC with pct=25medium
- Finding the sender's servermedium
- Odd Message-ID domainmedium
- A 1x1 image in the emailmedium
- User typed her password into a phishmedium
- Attacker still in after a resetmedium
- Which indicators to pullmedium
- Uploading a file to VirusTotalmedium
- Public scan of a personalised linkmedium
- A CAPTCHA that wants Win+Rmedium
- Endless MFA push promptsmedium
- Hash has zero detectionsmedium
- Invoice with only a phone numbermedium
- Paid to like videosmedium
- Malware in a reply to a real threadmedium
- Stopping silent mail forwardingmedium
- Checking a shortened linkmedium
- Security that works after deliverymedium
- Spotting lookalike domains earlymedium
- Phishing hosted on a real cloud servicemedium
- An image file that runs scriptmedium
- Phish in a meeting invitemedium
- Helpdesk chat from outsidemedium
- Lookalike domain in a payment chainmedium
Hard 31
- Phishing that bypasses MFAhard
- SPF and DKIM pass, DMARC failshard
- Strict SPF alignmenthard
- Forwarded mail still passes DMARChard
- Spoofing a made-up subdomainhard
- Phish that needs no passwordhard
- A code to enter at microsoft.com/deviceloginhard
- Signed spam from a good domainhard
- List mail fails at strict domainshard
- Rule found after account takeoverhard
- Scanner sees only a CAPTCHAhard
- File name that reads backwardshard
- Attacker uses the same email vendorhard
- One report, many inboxeshard
- Invisible words in the emailhard
- Real vendor, fake bank detailshard
- Login from a new country, no MFA prompthard
- A pop-up that is not a windowhard
- Why QR phishing is so effectivehard
- Working out simulation rateshard
- Moving to p=reject safelyhard
- Shortcut file in a ZIPhard
- Phishing on your own subdomainhard
- Caller asks helpdesk to reset MFAhard
- Control for bank detail changeshard
- OTPs going to the attackerhard
- Purging a borderline emailhard
- Passwords saved in the browserhard
- Email that is just one picturehard
- Why the first report time mattershard
- Spoofing your own brand to staffhard