Student Name
Class / Section
Grade / Year
Teacher
School
Instructions: Read each question carefully and answer to the best of your ability. Show all working for word problems.
1.
An email addresses the recipient as the “site owner,” includes a single hyperlink, and no other context. Propose two distinct adversary objectives behind such minimal-content lures and, for each objective, list at least two specific artifacts you would collect to confirm or disprove your hypothesis.
(2 pts)
2.
Design a scoring pipeline that triages URLs in inbound email using lexical, host-based, and behavioral features. Identify at least three features per category and explain how you would calibrate thresholds to minimize both false positives and false negatives.
(2 pts)
3.
Explain why SPF, DKIM, and DMARC passing results cannot be treated as a definitive safety signal. Provide one concrete attack scenario where all three may pass and propose two compensating controls.
(2 pts)
4.
Outline a safe dynamic analysis workflow for detonating a suspicious link that may conditionally serve payloads only to real users. Include environment preparation, network instrumentation, and methods to bypass basic cloaking.
(2 pts)
5.
A link resolves to a login page with branding similar to a major cloud provider, but the POST target differs from the visible origin. Describe the signals indicating credential exfiltration and two immediate containment actions.
(2 pts)
6.
Compare typosquatting, combosquatting, bitsquatting, and soundsquatting in terms of adversary cost, detection difficulty, and user deception effectiveness. Recommend distinct detection heuristics for each.
(2 pts)
7.
Given CT logs show a burst of certificates for many subdomains under a newly registered domain, and DNS has wildcard A records with low TTLs, infer likely attacker tactics and infrastructure goals.
(2 pts)
8.
Propose a regex- and DOM-structure-based detector for HTML credential harvesters that minimizes evasion by template changes. Specify signals that are robust to superficial obfuscation.
(2 pts)
9.
Argue for and against blocking newly registered domains (NRDs) at the email or web proxy for ownership-themed lures. Provide a risk-based policy that balances usability and security.
(2 pts)
10.
Explain how traffic cloaking based on IP reputation and device fingerprinting undermines sandbox detonation and describe two techniques to recover ground-truth behavior.
(2 pts)
11.
An email claims your site will be delisted from search results; the linked page requests payment via cryptocurrency. Identify indicators of a fraud operation across content, payment, and infrastructure layers.
(2 pts)
12.
You must choose between disabling all links in external emails or applying click-time evaluation. Build a decision framework considering attacker adaptation, user productivity, and residual risk.
(2 pts)
13.
Describe how to use DMARC aggregate (RUA) reports to identify abuse of your brand in ownership-themed phishing, and outline next steps once anomalies are detected.
(2 pts)
14.
Contrast static WHOIS data with passive DNS and certificate telemetry for adversary infrastructure attribution. When does WHOIS privacy hinder and when can alternative signals compensate?
(2 pts)
15.
Devise a controlled experiment to evaluate whether ownership-themed subject lines increase phishing click-through compared to generic lures. Specify experimental units, metrics, and ethical safeguards.
(2 pts)
16.
A redirection chain alternates between HTTP 302 and JavaScript-driven window.location changes across four domains, culminating in a data: URL page. Identify two reliable interception points for detection and justify why they are robust.
(2 pts)
17.
Propose a retro-hunt strategy to find historic emails related to a newly discovered phishing domain, using only logs and artifacts (no mailbox content). Include at least three log sources and matching approaches.
(2 pts)
18.
Explain how browser security indicators (padlock, EV/OV info) can create false trust in phishing and detail two UI/technical mitigations enterprises can deploy.
(2 pts)
19.
A cloud storage link hosts an HTML file that immediately iframes a phishing page on another domain. Discuss why naive URL allowlists fail and propose layered controls that preserve business use of cloud links.
(2 pts)
20.
Draft a playbook for responding to a widespread campaign targeting site administrators with ownership-themed lures. Include detection, containment, eradication, and recovery steps, and define measurable exit criteria.
(2 pts)
21.
A URL that decodes from a punycode form beginning with xn-- often indicates a potential
attack against users.
(1 pt)
22.
A DMARC policy that requests mailbox providers to quarantine messages failing alignment is set with p=
.
(1 pt)
23.
For DMARC SPF alignment, the RFC5321 envelope domain (also called the
domain) is compared to the RFC5322.From domain.
(1 pt)
24.
Serving benign content to sandboxes while delivering payloads to real users based on IP or fingerprint is known as
.
(1 pt)
25.
Using many randomized subdomains under a single registrable domain to evade reputation systems is characteristic of
.
(1 pt)
26.
Receivers annotate authentication outcomes in the email header field named
.
(1 pt)
27.
HTML forms can exfiltrate data to a different origin without needing CORS because browsers permit
.
(1 pt)
28.
Detecting lookalike domains by minimal edit operations commonly relies on the
distance algorithm.
(1 pt)
29.
A DNS configuration that maps any undefined subdomain to a single IP is implemented via a
record.
(1 pt)
30.
Proactively discovering brand abuse via newly issued TLS certificates is enabled by monitoring
logs.
(1 pt)