Phishing and Social Engineering Response Questions

Focuses on understanding social engineering and phishing attack mechanics, detecting suspicious messages, and operationally responding to suspected compromises. Topics include how phishing campaigns work, common indicators of compromise such as spoofed sender addresses and deceptive links, user reporting workflows, initial triage and containment of potentially impacted accounts or devices, forensic checks for lateral impact, resetting credentials and restoring account integrity, blocking malicious senders and communication channels, coordination between security operations and IT for remediation, preserving evidence and timelines, communication with affected users and stakeholders, training and awareness programs and simulated phishing exercises, and balancing user education with technical controls and email authentication and filtering strategies. Also covers how phishing incidents escalate into broader security incidents and how they integrate with the wider incident response and post-incident review processes.

HardTechnical

47 practiced

Describe methods attackers use to bypass SPF/DKIM/DMARC protections (for example, lookalike domains, compromised legitimate services, forwarding chains) and propose detection and mitigation strategies that operate beyond SPF/DKIM/DMARC (e.g., heuristics, ML models, display-name normalization, DMARC reporting analysis).

Sample Answer

**Overview — attacker techniques to bypass SPF/DKIM/DMARC**

- Lookalike domains: typosquatting, homoglyphs, subdomain trickery (mail.example.com.attacker.com) to appear legitimate.- Compromised legitimate services: attacker sends from a cloud provider, marketing platform, or breached mailbox that passes SPF/DKIM.- Forwarding/chaining: mailing lists or auto-forwards break SPF/DKIM alignment; DMARC may fail but user sees “trusted” sender.- Display-name spoofing: attacker uses a legitimate display name while From: address is different.- Similar-brand subdomains and internationalized domain names (IDN) to evade human detection.

**Detection strategies beyond SPF/DKIM/DMARC**

- Heuristics and rule-based checks: - Display-name vs envelope-from mismatch alerts. - Sender age, domain registration TTL, DNS history, and sudden volume spikes. - Link and attachment fingerprinting (URL reputation, domain age, redirect chains).- ML models: - Train models on features: lexical (domain similarity), behavioral (send patterns, IP geolocation), content (language anomalies), and link graph features. - Use ensemble models and continuously retrain with threat intel and false-positive feedback loops.- Display-name normalization: - Normalize Unicode to NFC, map homoglyphs to ASCII, collapse punctuation/whitespace, then compare to known brand names.- DMARC reporting analysis: - Aggregate RUA/RUF reports to detect systemic abuse (failed-but-high-volume senders), correlate with internal mailbox reports and MTA logs. - Automated triage to identify compromised third-party senders and request takedowns or update SPF include lists.- Telemetry fusion: - Combine MTA logs, SIEM alerts, endpoint telemetry, and gateway URL-click telemetry to link delivery to user actions.- Operational mitigations: - Enforce strict display policies in mail clients (show full email address), block or flag external senders, implement BIMI where useful. - Use third-party outbound sender verification, restrict auto-forwarding, and require DMARC enforcement for owned domains. - Rapid incident playbooks: revoke API keys, rotate service credentials, coordinate with providers and registrar for takedown.

**Why these work**- Attackers exploit authentication gaps and human trust; layered detection (behavioral + reputation + ML + user-visible indicators) reduces reliance on pure cryptographic auth and catches abuse that SPF/DKIM/DMARC miss.

MediumTechnical

50 practiced

Design a simulated phishing program for the organization. Define how you would choose targets (segmentation), cadence (frequency), performance metrics (click rate, credential submission), and remediation workflow for users who fail the simulation. Explain the ethical and privacy considerations.

Sample Answer

**Overview (role perspective)** As an InfoSec Analyst I’d build a risk-based simulated phishing program that informs training and reduces real-world risk while respecting privacy.

**Segmentation (targets)** - High-risk: executives, finance, IT admins — quarterly and realistic business-email simulations. - Medium-risk: managers, HR — bi-monthly. - Low-risk: general staff — quarterly baseline and occasional follow-ups. - New hires & contractors: onboarding simulation within first 30 days. Segmentation uses roles, access level, past click history, and business unit.

**Cadence** - Continuous program with rotating campaigns: 1 campaign per segment every 6–12 weeks; high-risk more frequent. - Randomize send times/days to avoid predictability; limit total simulated emails per user to 6–8/year to avoid fatigue.

**Performance metrics** - Primary: click rate (opened malicious link) and credential submission rate. - Secondary: report-to-IT rate, time-to-report, repeat offender count, remediation completion rate. - Track cohort trends month-over-month and by job function.

**Remediation workflow** - Immediate in-app feedback after simulation (educational landing page). - Automated ticket creation for failures, mandatory short micro-training (10–20 min) within 7 days. - For repeat offenders or privileged accounts: mandatory live coaching and temporary policy review with manager. - Metrics feed into awareness score used for targeted refreshers.

**Ethical & privacy considerations** - Avoid collecting sensitive personal data; anonymize results for org-level reporting. - Transparently document program in security policy and notify leadership; limit deception scope (no medical/legal/HR-sensitive themes). - Ensure legal review and union/compliance alignment; allow opt-outs for protected groups. - Use data retention limits and role-based access to simulation results.

This approach balances realistic testing, measurable improvement, and respect for employee privacy.

HardTechnical

90 practiced

You are handed logs that suggest a targeted spear-phishing campaign has led to multiple compromised accounts over several days. Describe how you would reconstruct the attacker timeline, identify indicators for pivot points, and propose containment and eradication steps to stop further spread. Be specific about log correlation and evidence you would collect.

Sample Answer

**Situation & goal**Build a forensic timeline from logs, find pivot points (where attacker moved laterally), and stop spread with containment + eradication. I’ll outline log correlation, evidence to collect, indicators to watch, and concrete remediation steps.

**1. Collect & preserve evidence**- Export relevant logs immediately from SIEM: email gateway (SMTP headers, subject, attachment hashes), Exchange/Office365 audit, EWS/Graph API, web proxy, VPN, firewall, DHCP, Active Directory (Domain Controller) auth logs, Windows Event (4624/4625, 4688 process creation), Sysmon, EDR telemetry, DNS, cloud logs (CloudTrail, Azure AD), and endpoint disk/memory images for high-value hosts.- Record timestamps, timezones, and hash raw artifacts (SHA256) to preserve chain-of-custody.

**2. Reconstruct timeline (log correlation)**- Normalize timestamps in SIEM to UTC; create master timeline indexed by user, host, and IP.- Start from initial compromise indicators: phishing email delivery time + link/attachment click events (URL click logs, Safe Links events) and correlate to subsequent web proxy or EDR network connections.- Correlate process creation (Sysmon 1/4688) on endpoint with outbound C2 (DNS queries, uncommon IPs, beacon patterns), and AD auth events showing new credentials or use of service accounts.- Map actions to MITRE ATT&CK techniques (Spearphishing → User Execution → Credential Dumping → Lateral Movement).

**3. Identify pivot points / indicators**- Sudden use of new admin credentials, atypical successful Kerberos TGS requests, Pass-the-Hash/Pass-the-Ticket evidence (Event IDs 4769/4672), remote execution tools (psexec, wmiexec), new scheduled tasks, PowerShell downloads with encoded commands.- Lateral movement markers: RDP sessions between internal hosts, SMB connections, lateral PowerShell remoting, suspicious service creation.- Host indicators: elevated process tree (cmd.exe → rundll32 → net.exe), new persistence (reg run keys, scheduled tasks), unknown binaries and modified LSASS memory dumps attempted.

**4. Containment steps (fast, prioritized)**- Isolate confirmed compromised endpoints from network (quarantine via EDR) but preserve volatile data (memory) if doing live forensics.- Disable compromised accounts and reset passwords via secure channel; invalidate active sessions and revoke tokens (Azure AD revoke).- Block malicious IPs/domains at firewall and proxy; add IOCs to EDR/SIEM for detection; apply email gateway rules to block campaign indicators.- Implement temporary privilege restrictions (require MFA enforcement, block legacy auth).

**5. Eradication & recovery**- For each compromised host: collect forensic image, malware samples, full event logs; perform disk reimage from known-good images after confirming root cause removed.- Rotate credentials for affected service accounts, change domain admin passwords, and rebuild any backdoored service.- Remediate identified vulnerabilities used for escalation (patch, disable vulnerable services).- Hunt for additional compromised accounts by searching SIEM for IOCs, unusual auth patterns, and replay attacks.

**6. Post-incident actions**- Conduct full IOC sweep across environment, gap analysis of controls (MFA, patching, EDR coverage), and update detection rules.- Provide indicators and timeline to threat intel team; report to stakeholders and, if required, regulators.- Implement user awareness for phishing and simulate follow-ups.

**Evidence & artifacts to collect (summary)**- Email headers, message IDs, attachment/file hashes, clicked URLs- Sysmon/Windows event logs, EDR process/network artifacts, memory dumps- AD authentication logs, Kerberos tickets, VPN logs, DHCP leases, proxy/DNS logs- Network captures for C2 traffic

This approach ensures a defensible timeline, identifies pivot points by correlating auth/process/network events, and contains/eradicates while preserving forensic integrity.

MediumSystem Design

88 practiced

Design a practical phishing triage playbook for the SOC for a mid-size enterprise (500–2000 employees). The playbook should include decision points for 'user clicked link', 'user submitted credentials', and 'attachment executed', and list the responsible roles and SLAs for each step.

Sample Answer

**Overview**A concise SOC triage playbook for phishing incidents (500–2000 employees) with decision branches for: user clicked link, user submitted credentials, attachment executed. Goals: contain fast, preserve evidence, restore service, and reduce phishing click-to-compromise time.

**Roles & SLAs (summary)**- Tier 1 Analyst (T1) — initial triage, enrich alerts. SLA: 15 min initial response.- Tier 2 Analyst (T2)/Threat Hunter — deep analysis, pivoting. SLA: 60 min containment decision.- Endpoint Team / EDR Engineer — containment/remediation on endpoints. SLA: 2 hours for containment actions.- Email Admin / M365 Security — block sender/URL, remove messages. SLA: 30–60 min for blocking/removal.- IR Lead / SOC Manager — coordinate incident, escalate to Legal/HR. SLA: 1 hour to assign incident severity.- Legal / HR / PAM Team — for credential compromise and data exposure. SLA: 4 hours to provide guidance.

---

**1) User clicked link (no credentials submitted)**- T1: Confirm alert, capture email headers, URL, user, device, and session logs. (15 min)- Decision: Is URL known-malicious or redirects to credential page? - If benign / false positive → T1 close with user education (SLA 24 hrs). - If suspicious/malicious → T1 escalate to T2 (60 min).- T2: Analyze URL in sandbox, check web gateway/Proxy logs, look for drive-by download. If redirect to exploit → Endpoint Team isolate device and perform EDR scan (2 hrs).- Email Admin: Block URL, sender, and remove similar emails org-wide (30–60 min).- Outcome: Remediate, reset user sessions, user awareness notification.

---

**2) User submitted credentials**- T1: Immediate validate submission evidence (phish URL/form), collect headers and auth logs; force session revocation and MFA prompt. (15 min)- Decision: Are credentials single-factor or include corporate SSO? - If SSO/Privileged → IR Lead escalate to Legal/PAM and T2 immediately (within 30–60 min).- T2/PAM: Rotate compromised credentials, revoke tokens, force password reset & MFA re-enrollment, perform lateral movement hunt. (2–4 hrs)- Email Admin: Block source, remove messages. Endpoint Team: scan endpoints for persistence. Legal/HR: advise on disclosure if data access occurred. - Outcome: Confirm no unauthorized access, close with user training and log review.

---

**3) Attachment executed**- T1: Capture file hash, isolate host via EDR, preserve memory/image snapshots. (15 min)- Decision: Does static/dynamic analysis show malware or ransomware indicators? - If benign → restore host; if malicious → T2/Threat Hunter full IR (contain, eradicate). (60 min decision)- Endpoint Team: Quarantine device, perform forensic triage, rebuild if needed (2–8 hrs depending on severity).- T2: Hunt for indicators across network and endpoints, identify IOCs, update detection rules.- IR Lead: Notify stakeholders, consider user communications and legal if data exfiltration. - Outcome: Eradicate, restore from clean image, post-incident review and signature deployment.

---

**Evidence & Documentation**- At every step: ticketing system entry, timeline, artifacts (headers, pcap, EDR logs, sandbox reports), decision rationale, and remediation steps.

**Post-Incident**- SLA: Post-mortem within 72 hours; training & phishing simulation within 2 weeks for affected groups; update IOC blocks and detection rules within 24 hours after validation.

This playbook balances speed and thoroughness for a mid-size enterprise, assigning clear roles and time-bound actions to minimize damage and recurrence.

MediumTechnical

59 practiced

Describe an appropriate credential-reset protocol after a suspected credential compromise. Include steps for password reset scope (single account vs domain-wide), session and token revocation (web sessions, OAuth tokens), MFA reassessment, and communication with the user and IT.

Sample Answer

Situation & goalI would treat a suspected credential compromise as a containment-first incident: determine scope quickly, stop active access, then remediate and validate.

Step 1 — Triage & scope- Review logs/alerts (SIEM, auth logs, VPN, endpoint EDR) to identify affected username(s), source IPs, timeframes, and sign-in anomalies.- Decide scope: if evidence shows only one account breached (isolated IP, single device), start with single-account reset; if lateral activity, multiple accounts, reused passwords, or domain-level indicators exist, escalate to domain-wide reset.

Step 2 — Containment: credentials & sessions- Force a password reset for scoped accounts immediately.- Revoke all active web sessions and refresh tokens: - Invalidate session cookies and server-side session stores. - Revoke OAuth refresh tokens and API keys; rotate client secrets where used. - Invalidate long-lived tokens (service accounts) and replace with rotated credentials.- Block suspicious IPs and device endpoints in the short term.

Step 3 — MFA reassessment- Require re-enrollment of MFA for reset accounts if there’s evidence of MFA compromise (SIM swap, MFA device lost) or when attacker bypass is suspected.- For lower-risk cases, force reauthentication with existing MFA; for high-risk, require new authenticator registration (hardware token or supported app).

Step 4 — Communication & coordination- Notify affected user(s): explain actions taken, instruct immediate actions (confirm identity via secure channel), and provide temporary access workflow if needed.- Notify IT/Helpdesk: prepare verification procedures, account unlock processes, and support for MFA re-enrollment.- Notify leadership and incident response as per IR plan when scope > single user or exfiltration suspected.

Step 5 — Validation & monitoring- Monitor accounts and related assets for recurring anomalies for 7–30 days.- Conduct endpoint scans on user devices; require remediation before restoring privileges if malware found.- Log all changes and evidence for post-incident review.

Post-incident- Conduct root-cause analysis, update password/MFA policies (password reuse prevention, token lifetimes), and run targeted user education.- Apply lessons to improve detection (add alerts for token abuse, anomalous MFA change).

Unlock Full Question Bank

Get access to hundreds of Phishing and Social Engineering Response interview questions and detailed answers.

Join thousands of developers preparing for their dream job.