Inbound Threat Protection (Phishing, BEC, Malware, URL and Attachment Sandboxing)
This domain tests the inbound filtering pipeline and where each control sits in it. Expect questions about why a message was delivered, why a blocking control failed, and which policy layer should be changed.
The pipeline, in order
- Connection filtering – IP reputation, blocklists, directory-based edge blocking.
- Recipient validation – directory lookups; reject unknown recipients early.
- Malware scanning – signatures and heuristics against the payload.
- Content and URL filtering – spam scoring, phishing signals, reputation of embedded links.
- Policy layer – impersonation protection, DMARC enforcement, transport rules, tenant allow/block lists.
- Delivery – inbox, junk, quarantine, or replacement by a safe-attachment wrapper.
Impersonation and BEC
BEC frequently carries no payload and no link: it relies on display-name spoofing, a lookalike domain, a freemail reply-to, or a first-contact supplier. Detection therefore depends on mailbox intelligence, directory-based impersonation lists, domain similarity scoring, and DMARC failure on the From domain - not on attachment scanning.
Sandboxing and time-of-click
Attachment detonation runs files in a virtual machine and observes behaviour, catching new malware families that signatures miss. URL detonation follows redirects and, at click time, re-evaluates the destination - which is what catches a benign page that is weaponised after delivery. Detonation policy forces a trade-off: deliver-then-replace (wrapper link) versus hold-for-verdict (delay).
Post-delivery
Zero-hour auto purge retracts already-delivered messages when campaign intelligence or signatures update. Submissions and tenant allow/block lists tune the system, but allow entries can silently override impersonation and spoof protections - a frequent cause of bypass.
Worked example
An accounts-payable PDF arrives clean and links to a reputable file-sharing tenant. Four days later that tenant's shared page starts serving a credential form. Because URL detonation is set to re-check at click, the click is blocked, and zero-hour auto purge sweeps copies already in other inboxes. Reasoning: reputation captured at delivery is a point-in-time judgement, so protection must persist after delivery.
Traps
- Treating the attachment sandbox as coverage for links to cloud storage.
- Adding a sender to the allow list and disabling impersonation protection for that identity.
- Assuming quarantine notifications improve safety - they increase release-by-user risk.
- Applying safe links or safe attachments policies to a subset of recipients and assuming tenant-wide coverage.
- Confusing spam confidence level thresholds with phish confidence level thresholds.