PCES flashcards
PCES · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- SPF record syntax
- An SPF record is a DNS TXT record starting with v=spf1 followed by mechanisms and qualifiers that authorize sending IPs for the domain.
- SPF lookup limit
- SPF evaluation allows a maximum of 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect); exceeding causes a permerror and typically fails authentication.
- DKIM selector
- The selector is a label in the DKIM DNS record (selector._domainkey.domain) that identifies the key pair used to sign a message, allowing multiple active keys.
- DMARC alignment
- DMARC requires that the From domain matches the domain authenticated by SPF or DKIM. Relaxed alignment allows organizational domain match; strict requires exact match.
- DMARC policy values
- p=none (monitor), p=quarantine (treat as suspicious), p=reject (reject). pct specifies percentage of messages to which policy applies.
- DMARC aggregate reports
- Aggregate reports (rua) are XML summaries sent daily by receivers to domain owners, showing authentication results and sources for messages using the domain.
- DKIM body hash
- The DKIM body hash is a cryptographic hash of the message body, included in the DKIM-Signature header; it ensures integrity of the body during transit.
- SPF softfail vs fail
- Softfail (~all) marks unauthorized senders as suspicious but not rejected; fail (-all) instructs receivers to reject. Softfail is often used during testing.
- MX record priority
- MX records have a preference number; lower values are tried first. Multiple MX records provide redundancy and load balancing for inbound email.
- Connectors in Microsoft 365
- Connectors define mail flow between Microsoft 365 and external systems, enforcing security like TLS and certificate-based authentication for hybrid or partner scenarios.
- Transport rules
- Transport rules (mail flow rules) apply conditions and actions to messages in transit, such as blocking, redirecting, or adding disclaimers, evaluated in priority order.
- Accepted domains
- Accepted domains are domains for which the cloud tenant receives email. Types: authoritative (hosts mailboxes), internal relay, and external relay.
- Hybrid coexistence
- Hybrid coexistence integrates on-premises Exchange with cloud mailboxes, requiring shared namespace, connectors, and Autodiscover configuration for seamless mail flow.
- Safe Attachments
- Safe Attachments detonates email attachments in a sandbox to detect malicious behavior before delivery, blocking or replacing harmful files.
- Safe Links
- Safe Links rewrites URLs in email and checks them at click time against threat intelligence, blocking access to malicious sites even after delivery.
- Anti-phishing policies
- Anti-phishing policies configure impersonation protection, spoof intelligence, mailbox intelligence, and safety tips to detect and act on phishing attempts.
- Tenant Allow/Block List
- TABL overrides filtering verdicts for specific senders or domains. Allow entries bypass spam filtering; block entries prevent delivery. Use sparingly with documentation.
- Spam Confidence Level (SCL)
- SCL is a score from -1 to 9 indicating spam likelihood. Higher values are more likely spam; -1 means bypass filtering. Thresholds determine actions like quarantine.
- Quarantine policies
- Quarantine policies define user access to quarantined messages: view, release, request release, or no access, and whether notifications are sent.
- Message trace
- Message trace follows email delivery path in the cloud, showing sender, recipient, status, and events; used to investigate delivery failures or malicious mail.
- Authentication-Results header
- This header, added by receiving servers, reports SPF, DKIM, and DMARC pass/fail results and the authenticating domain, aiding investigation of spoofing.
- Search and purge
- Search and purge uses compliance search to find malicious emails across mailboxes and remove them, containing a phishing campaign after delivery.
- Inbox rule persistence
- Attackers create hidden inbox rules to forward or delete security alerts, maintaining access. Investigators must review and remove malicious rules.
- Chain of custody
- Chain of custody documents evidence handling from collection to presentation, including hashes and timestamps, ensuring integrity for legal or disciplinary proceedings.
- Opportunistic TLS
- Opportunistic TLS attempts encryption via STARTTLS but falls back to cleartext if the other server does not support it; enforced TLS prevents fallback.
- S/MIME
- S/MIME uses certificates for end-to-end email encryption and digital signatures, ensuring confidentiality and authenticity independent of transport.
- Data Loss Prevention
- DLP inspects email content for sensitive data patterns and applies actions like block, encrypt, or notify, enforcing compliance policies.
- Retention labels
- Retention labels apply retention or deletion rules to email and can trigger encryption, supporting compliance with legal and regulatory requirements.
- Litigation hold
- Litigation hold preserves mailbox content, including deleted items, for eDiscovery and legal compliance, preventing permanent deletion.
- Conditional Access
- Conditional Access evaluates signals like user, device, location, and app to enforce access controls such as MFA or block, integrating with identity protection.
- Modern authentication
- Modern authentication uses OAuth 2.0 token-based flows, enabling MFA and conditional access; basic authentication is deprecated and insecure.
- Privileged Identity Management
- PIM provides just-in-time privileged role activation with approval and time-bound assignments, reducing standing administrative access risk.