PCES study plan
PCES · Give each week a clear focus.
8 weeks · About 6 hours per week
Email Authentication and Domain Protection (SPF, DKIM, DMARC)
Explain the SPF evaluation process, including the 10-DNS-lookup limit and the 2-void-lookup limit, and list three mechanisms that avoid lookup inflation.
Configure a DKIM signing setup for a test domain using a 2048-bit RSA key and publish the public key in DNS.
Compare DMARC p=none, p=quarantine, and p=reject policies, and describe how alignment and reporting work.
Identify common SPF and DKIM misconfigurations that cause authentication failures.
Your checkpoint
A one-page reference sheet with a working SPF record, DKIM DNS record, and DMARC record for a test domain, plus a checklist of five misconfigurations to avoid.
Email Authentication and Domain Protection (SPF, DKIM, DMARC) & Threat Detection, Filtering, and Anti-Phishing Controls
Analyze DMARC aggregate reports to distinguish legitimate senders from spoofing attempts.
Configure DMARC forensic reporting and explain privacy considerations.
Evaluate how DMARC policy interacts with mailing lists and forwarders, and propose mitigation strategies.
Describe how SPF, DKIM, and DMARC results feed into filtering decisions.
Your checkpoint
A written analysis of a sample DMARC aggregate report identifying at least three sending sources and recommending policy adjustments.
Cloud Email Platform Architecture and Configuration
Diagram the mail flow for inbound, outbound, and internal messages in a cloud email platform, labeling each security control point.
Compare transport rules, connectors, and journaling for routing and compliance.
Configure a connector to route mail through a third-party security service and validate the setup.
Explain how hybrid coexistence with on-premises Exchange affects mail routing and authentication.
Your checkpoint
An architecture diagram of a cloud email tenant with inbound/outbound connectors, transport rules, and a written explanation of mail flow for three scenarios.
Threat Detection, Filtering, and Anti-Phishing Controls
Configure anti-phishing policies including impersonation protection, mailbox intelligence, and safety tips.
Design a layered filtering strategy using malware, spam, and bulk mail policies.
Evaluate attachment and URL protection features, including time-of-click detonation.
Tune a filtering policy to reduce false positives while maintaining detection efficacy.
Your checkpoint
A configured anti-phishing and filtering policy set for a test tenant, with a before/after comparison of false positive and false negative rates using sample messages.
Incident Response and Investigation for Email-Borne Attacks
Execute a tabletop investigation of a phishing incident using message trace and audit logs.
Collect and preserve evidence from a compromised mailbox while maintaining chain of custody.
Contain a business email compromise incident by resetting credentials, revoking sessions, and applying inbox rules.
Document an incident timeline and root cause analysis.
Your checkpoint
An incident response report for a simulated BEC attack, including timeline, evidence log, containment actions, and lessons learned.
Data Protection, Encryption, and Compliance in Email
Compare encryption options such as TLS, S/MIME, and message encryption, and select appropriate use cases.
Configure data loss prevention policies for sensitive information types in email.
Apply retention and labeling policies to meet compliance requirements.
Explain how customer lockbox and privileged access management affect data access.
Your checkpoint
A compliance matrix mapping three regulatory requirements (e.g., GDPR, HIPAA, PCI) to specific email encryption, DLP, and retention configurations.
Identity, Access, and Integration with Cloud Security Ecosystems
Integrate cloud email with an identity provider using SAML/SCIM for authentication and provisioning.
Configure conditional access policies that enforce MFA and block legacy authentication.
Describe how OAuth consent and application permissions can be abused in email attacks.
Evaluate the security posture of third-party integrations and APIs.
Your checkpoint
A configuration guide for SSO and conditional access in a test tenant, including a risk assessment of two third-party integrations.
Email Authentication and Domain Protection (SPF, DKIM, DMARC) & Threat Detection, Filtering, and Anti-Phishing Controls & Incident Response and Investigation for Email-Borne Attacks
Review weak areas across all domains using practice questions and hands-on labs.
Reconfigure a DMARC policy from p=none to p=reject based on report analysis.
Simulate a phishing attack and validate detection and response capabilities.
Create a personal checklist for exam-day decision-making.
Your checkpoint
A final capstone project: a secure email configuration for a mock organization covering authentication, filtering, and incident response, with a one-page summary of lessons learned.
Milestones
Week 2: Successfully authenticate a test domain with SPF, DKIM, and DMARC, and correctly interpret a DMARC aggregate report to identify a spoofing attempt.
Week 4: Demonstrate a working anti-phishing policy that blocks a simulated impersonation attack while allowing legitimate bulk mail, with documented false positive/negative metrics.
Week 6: Implement and document an email encryption and DLP solution that meets at least two compliance requirements, verified by a test scenario.
Week 8: Complete a full incident response simulation and achieve a score of 80% or higher on a practice exam covering all domains.