What is the primary function of the People Page in the Threat Protection Workbench and TAP Dashboard?
Answer : D
The People Page is a user-centric investigation view designed to help analysts quickly identify who is being targeted and who is most at risk/impacted by threats (D). Instead of starting from a single message, responders can pivot from user risk signals---Attack Index, exposure metrics, click behavior, VIP status, and repeated campaign targeting---to build a prioritized queue for investigation. In Proofpoint IR operations, this supports rapid triage during active phishing/BEC waves: analysts identify the highest-risk users first (those with permitted clicks or delivered accessible threats), then perform immediate follow-up actions such as credential resets, session/token revocation, mailbox rule review, and targeted comms. The People Page is not an access control manager and it is not the place to configure granular filtering rules per user (that's policy/admin territory). It's also distinct from security awareness simulation dashboards, though it can inform who should receive training based on risky behavior. As part of detection and analysis, the People Page helps convert large-scale threat telemetry into actionable, person-focused response steps, minimizing dwell time and reducing the chance that the most exposed users are missed.
Question 2
An analyst wants to use the Threats page in TAP Dashboard to review all messages related to a phishing campaign that contain an attachment. What is the correct method to filter these messages?
Answer : A
The TAP Threats page is designed for investigation by applying structured filters that constrain the dataset by threat category (e.g., phishing), grouping (e.g., campaigns), and threat type (e.g., attachment vs URL). Using the threat filter controls (A) is the most reliable, repeatable method because it leverages the dashboard's native taxonomy and ensures you are viewing only messages that meet both conditions: campaign association and attachment presence. The Impacted tab (B) is user-impact oriented and does not inherently filter to ''phishing campaign + attachment''; it is used after threats are identified to see interactions. The Highlighted tab (D) is focused on notable techniques and analyst-marked items rather than campaign scoping. While the search bar can be useful for pivots, the most ''documented workflow'' approach for consistent IR triage is applying the built-in threat filters, which also supports sharing consistent views across analysts and generating stable results for incident notes and reporting. This is aligned with Proofpoint IR operational practice: filter pivot into details scope recipients take remediation actions.
Question 3
In which part of the SMTP conversation can threat actors spoof information to make the message look safe to the recipient?
Answer : D
Threat actors most commonly spoof what the recipient visually trusts---primarily fields displayed by mail clients---by manipulating message headers (D), especially From:, Reply-To:, and Return-Path-related presentation cues (even though some are derived from envelope, the client display is header-driven). While the SMTP envelope can be spoofed during transmission, the ''look safe to the recipient'' effect is achieved through header content because that is what appears in the inbox preview and open-message view. Proofpoint investigations validate this by comparing: RFC5322.From vs RFC5321.MailFrom (envelope), authentication results (SPF/DKIM/DMARC), and alignment. Spoofed headers are central to BEC, display-name spoofing, and executive impersonation, and Proofpoint's sender analysis and authentication panels help responders quickly identify mismatches and impersonation risk. In IR triage, analysts examine the full headers to reconstruct the true path (Received chain), identify forged identity indicators, and determine whether the message bypassed defenses due to weak DMARC enforcement, allow-listing, or trusted-partner misconfiguration.
Question 4
For which two reasons should organizations customize their incident response plans based on NIST SP 800-61 or another incident response standard? (Select two.)
Answer : D, E
Standards like NIST SP 800-61 provide a proven framework, but incident response must be operationalized to the organization's reality. Customization is required to match mission, size, structure, and functions (D)---for example, whether the organization is regulated (financial/health), globally distributed, heavily supplier-dependent, or cloud-first. These factors determine evidence retention, legal notification triggers, escalation thresholds, and which teams own containment steps (email admin vs SOC vs IAM). Customization also improves effectiveness/efficiency by creating a repeatable process and documented handoffs (E): who triages TAP alerts, who executes TRAP pulls, who updates URL Defense blocklists, who performs account resets/token revocation, and how comms are handled with executives and end users. In Proofpoint-driven IR, handoffs are particularly important because email incidents often cross functional boundaries (SOC messaging team IAM helpdesk legal). Making plans ''more generic'' (A) is counterproductive; standards are already generic. Documenting every MSSP analyst contact (B) is fragile; role-based contacts are better, but that's not the key reason for customizing a standard. Changing lifecycle order (C) is not the objective; improving fit and execution is.
Question 5
Which two factors make Business Email Compromise (BEC) attacks difficult to detect? (Select two.)
Answer : C, D
BEC is difficult to detect primarily because it often lacks ''traditional malware signals'' and instead relies on human deception. Social engineering (C) is core: attackers craft believable narratives (invoice urgency, legal requests, gift card scams, payroll changes) tailored to organizational context. Impersonation (D) is the second pillar: display-name spoofing, lookalike domains, compromised vendor accounts, and executive/finance role impersonation. These tactics can produce messages that are text-only, low-volume, and free of obviously malicious attachments/URLs, making signature-based or URL reputation controls less effective. Proofpoint-specific defenses therefore emphasize identity and relationship signals (impostor detection, supplier risk, unusual sending patterns), authentication (SPF/DKIM/DMARC alignment), and behavioral context (who typically emails whom, anomalies in reply chains, newly observed domains). In IR, analysts triage BEC by validating headers, checking domain age and similarity, confirming invoice/payment workflows out-of-band, and scoping for mailbox compromise (rules/forwarding, suspicious OAuth grants). Because BEC ''looks normal'' at the technical layer, effective detection requires combining Proofpoint telemetry with process controls and fast escalation to business stakeholders.
Question 6
Which of the following is an item that should be included in an incident report as part of the post-incident debrief?
Answer : C
A high-quality incident report captures what the adversary did in a way that enables prevention and detection improvements. Including adversary tactics and techniques (C) is essential because it translates raw artifacts (emails, URLs, headers, click events) into actionable security engineering outcomes: which initial access method was used (credential phishing vs BEC), which impersonation technique (display name, lookalike domain, supplier compromise), what persistence was attempted (mailbox rules/forwarding, OAuth consent), and what objectives were pursued (invoice fraud, data theft, lateral phishing). In Proofpoint-centered IR, mapping tactics and techniques supports targeted control tuning: URL Defense policy, attachment sandboxing, impostor rules, DMARC enforcement, and TRAP automation; it also improves analyst playbooks (what pivots to run next time, what indicators to hunt). The incident response plan (B) is a reference document, not an incident-specific report item. Network diagrams (A) may be helpful in some incidents but are not always relevant for email-led events. Threat landscape reporting (D) is contextual intel, but the report must focus on what occurred in this incident and what to change to reduce recurrence, which is best captured via tactics/techniques.
Question 7
As an information protection security analyst, what should you do to ensure that escalation documentation is up to date?
Answer : D
Escalation paths are operational safety rails: they ensure the right stakeholders can be reached quickly under time pressure (e.g., suspected account takeover, executive impersonation, data loss). The correct practice is to update escalation documentation whenever people or roles change in ways that affect communication paths (D). In Proofpoint-centric IR, the ''who do we contact'' question is time-critical because containment actions may require identity admins (account disable/reset/token revocation), email admins (transport rules, allow/block changes, TRAP pulls), legal/privacy (breach assessment), and business owners (wire-transfer verification). Waiting for HR (A) introduces delay and gaps; relying only on department-level contacts while ''ignoring'' role changes (B) is risky because specific authorities are needed (e.g., the person who can approve emergency mailbox search or enforce MFA). Reviewing only during major incidents (C) fails because the first time you discover stale contacts is the worst time. Best practice is a living escalation matrix tied to on-call rotations, role-based distribution lists, and tested quarterly via tabletop drills, ensuring Proofpoint remediation and comms steps can be executed without bottlenecks.
All Official Question Types