CC-CEM flashcards
CC-CEM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- MX preference value
- A numeric priority on an MX record; the lowest number is tried first. Equal values indicate load sharing among equally capable hosts.
- Internal relay domain
- An accepted domain type where the cloud accepts mail for unknown recipients and forwards it to an on-premises server rather than returning a non-delivery report.
- Hybrid coexistence
- A deployment where mailboxes exist both on-premises and in the cloud, with shared address space, synchronized directory, and connectors routing mail in both directions.
- SPF DNS lookup limit
- SPF evaluation permits at most ten DNS-querying mechanisms and modifiers. Exceeding the limit produces a permerror, which receivers treat as no valid SPF result.
- SPF softfail
- The ~all qualifier marks unauthorized senders as suspicious rather than rejected. Receivers may still accept the message but usually increase its spam score.
- DKIM body hash
- A hash of the canonicalized message body stored in the bh= tag. Any body modification after signing invalidates the signature unless the canonicalization tolerates it.
- DMARC alignment
- The requirement that an authenticated SPF or DKIM domain match the From header domain. Relaxed mode compares organizational domains; strict mode requires an exact match.
- ARC seal
- A set of headers added by a forwarding intermediary that preserves prior authentication results, allowing the final receiver to validate the chain.
- DMARC aggregate report
- A daily XML summary sent to the rua address listing message counts by source IP and disposition, used to inventory senders before enforcing policy.
- Business email compromise
- A social-engineering attack using a trusted or impersonated identity to induce payment or data disclosure, typically without malware or malicious links.
- Time-of-click protection
- A URL rewriting technique where the link is re-evaluated at click time, blocking destinations that became malicious after delivery.
- Detonation
- Execution of a suspicious file or URL in an isolated sandbox environment to observe behavior and produce a benign, malicious, or unknown verdict.
- Impersonation protection
- A policy that detects display-name, domain, or lookalike-domain spoofing of protected users and domains, applying quarantine or junk actions.
- Zero-hour auto purge
- Retroactive removal or quarantine of messages already delivered to mailboxes after a signature or detonation verdict is updated to malicious.
- DLP sensitive information type
- A pattern definition combining a regular expression with corroborative evidence and a confidence level, used by data loss prevention rules to classify content.
- Policy tip
- An inline notification shown to a sender when a message matches a DLP rule, explaining the violation and offering an override with business justification.
- Opportunistic TLS
- A connector setting that attempts encryption and falls back to plaintext when the peer does not support TLS, unlike forced TLS which rejects delivery.
- Office Message Encryption
- A recipient-experience encryption service that delivers an HTML wrapper with a time-limited link, authenticated by one-time passcode or federated identity.
- Document fingerprint
- A DLP detection method that hashes a standard template form so that derivative documents containing the same structure are identified as sensitive.
- Multi-geo residency
- A configuration that pins mailbox and content storage to specified geographic regions while keeping a single tenant and directory.
- Retention label
- An item-level classification that sets retention duration and disposition behavior, optionally triggering review before permanent deletion.
- Customer Lockbox
- An approval workflow requiring explicit tenant consent before a provider engineer can access customer content for support, with full audit logging.
- Recoverable Items folder
- A hidden mailbox folder holding soft-deleted, purged, and hold-protected items. Its quota must be increased for long litigation holds.
- Conditional Access
- A policy engine that evaluates user, device, location, application, and risk signals, then grants access, requires additional controls, or blocks.
- Legacy authentication
- Older protocols such as basic SMTP AUTH, IMAP, POP, and basic ActiveSync that cannot enforce multi-factor authentication and should be blocked.
- Application permission
- A Graph API permission granted to an app acting without a signed-in user; it requires admin consent and is broader than delegated access.
- Privileged Identity Management
- A service providing just-in-time, time-bound, approval-gated activation of administrative roles, reducing standing privileged access.
- Unified audit log
- A tenant-wide record of mailbox, admin, and eDiscovery activity, retained 180 days by default and searchable for investigations.
- Message trace
- A search over transport logs showing sender, recipient, timestamps, status, and event details for messages within the retention window.
- Network message ID
- A unique identifier assigned to a message by the transport service, used to correlate trace, alert, and Defender records during investigation.
- Cutover migration
- A one-time migration of all mailboxes to the cloud, typically limited to about two thousand mailboxes, followed by an MX record switch.
- Hybrid Configuration Wizard
- A tool that provisions connectors, accepted domains, and federation trust needed for coexistence between an on-premises Exchange organization and the cloud.