CC-CEM case studies
CC-CEM · Put your knowledge to work in context.
The CC-CEM (Certified Cloud Email Security Professional) is an independent vendor-neutral credential aimed at practitioners who secure email in cloud-hosted environments such as Microsoft 365, Google Workspace and hybrid gateways. It suits security engineers, email administrators, SOC analysts and consultants who already operate mail flow and now need to defend it. The CC-CEM case studies are 5 cases and about 3,262 words.
1Routing a Post-Acquisition Domain Through a Central SMTP Gateway
Northwind Health has 6,200 mailboxes in Microsoft 365 and acquires a 900-user clinic group running Google Workspace. For 9 months, both tenants must coexist.
724 words, about 4 min2Staged DMARC Enforcement With a Payroll Provider and Mailing Lists
Contoso Finance has published DMARC p=none for contoso.example for 14 months. Aggregate reports show 92% of its 1.8 million monthly messages pass DMARC, but four sources fail: (1) a payroll SaaS sends 120,000 messages per month using contoso.example in From, with SPF pass but no DKIM; (2) an internal application sends via an unauthenticated on-premises relay; (3) a partner mailing list re-sends Contoso marketing mail with the original From domain and breaks DKIM; (4) a subsidiary sends from a subdomain with its own SPF but no DKIM.
611 words, about 3 min3A Geofenced Credential-Phishing Link That Sandboxes Clean
Fabrikam Legal has 2,400 users on Exchange Online Protection with Defender for Office 365 Plan 2. Over 11 days, 38 users receive emails from a lookalike domain, fabrikam-legal[.]com, with the display name of the managing partner.
650 words, about 3 min4DLP Blocks Invoices, Sales Encrypts With ZIP Passwords
Tailspin Toys has 1,100 users on Microsoft 365 E5. A DLP policy blocks any email containing 13-19 digit numbers near the word 'invoice' to external recipients, with a policy tip.
623 words, about 3 min5Business Email Compromise: Containing a Mailbox Rule and Preserving Evidence
Adventure Works has 5,000 mailboxes in Exchange Online, 30-day mailbox audit log retention, and a third-party SIEM ingesting the Unified Audit Log with 90-day retention. On a Friday, the AP clerk reports that a vendor's bank details changed by email; the message came from a legitimate vendor domain but a lookalike display name.
654 words, about 3 min