Threat Detection, Filtering, and Anti-Phishing Controls
Threat Detection, Filtering, and Anti-Phishing Controls
This domain tests layered detection: reputation, authentication, content inspection, detonation, and user-facing controls. The exam favors operational judgment over product menus.
Core rules
- Filtering layers include connection filtering, anti-spam, anti-malware, phishing and impersonation protection, safe attachments, and safe links. Each layer has its own verdict and policy action.
- DMARC enforcement is necessary but not sufficient. A free-webmail account can pass SPF and DKIM for its own domain while spoofing a display name; impersonation protection and mailbox intelligence catch that pattern.
- URL rewrite and detonation provide click-time protection; without rewrite, a link that was clean at delivery may be malicious later.
- Tenant allow/block lists and quarantine policies can override automated verdicts. Allow entries are a common cause of missed phishing.
Worked example
A CFO receives a message from a Gmail address with display name CFO. SPF and DKIM pass for gmail.com, but DMARC alignment is with gmail.com, not the company domain. Authentication alone will not block it. The correct control is impersonation protection or a transport rule that flags display-name matches for executive titles, plus user reporting.
Traps
- Treating an SPF or DKIM pass as proof the visible sender is genuine.
- Releasing quarantined mail without checking the original authentication results.
- Letting a broad allow list bypass malware or phishing verdicts.
- Assuming safe links work when URL rewrite is disabled.