Proofpoint Email Security Specialist case studies
Proofpoint Email Security Specialist · Put your knowledge to work in context.
This page is an independent study guide for the Proofpoint Email Security Specialist credential. It is written for email administrators, security engineers and SOC analysts who configure and operate Proofpoint email protection day to day, and for candidates who want a structured way to revise before sitting an exam. The Proofpoint Email Security Specialist case studies are 5 cases and about 5,244 words.
1Northwind Health: moving DMARC from p=none to reject with a broken SPF chain
Northwind Health (12,000 mailboxes) is preparing to move its DMARC record from p=none to enforcement. The current record is: v=DMARC1; p=none; rua=mailto:[email protected]; pct=100.
966 words, about 5 min2Contoso Logistics: rule order, per-user safe senders, and a quarantine that swallows supplier invoices
Contoso Logistics (6,000 users) runs Proofpoint Email Protection for inbound mail. The org-level rule set contains, in this order: R1 'InvoiceQuarantine' - direction inbound, subject matches invoice remittance payment, action quarantine, stop processing further rules; R2 'APSupplierAllow' - sender domain in {supplier-a.example, supplier-b.example}, recipient in ap-team@, action allow and continue; R3 'BulkTag' - message carries a List-Unsubscribe header, action add header X-Bulk:yes and continue.
965 words, about 5 min3Fabrikam: lookalike-domain BEC that authenticates perfectly and carries no payload
Over three days, six finance users at Fabrikam (2,300 users) each received two to four short emails from 'Anita Rao <[email protected] '; the real CFO is [email protected]. The lookalike domain was registered nine days before the first message and publishes SPF -all, a DKIM signature, and DMARC p=reject for its own domain.
1,034 words, about 5 min4Meridian: 62-message credential phish, three compromised accounts, and a manual pull decision
At 14:05 on Tuesday a credential-phishing campaign hit Meridian (9,000 mailboxes): 62 messages across 41 recipients, subject 'Shared document: Q3 forecast', linking to a cloned Microsoft sign-in page on a domain registered two days earlier. Proofpoint delivered all 62.
1,150 words, about 6 min5Tailspin: a 'delivered' message the user cannot find, and two blocked-count numbers that disagree
A user at Tailspin (4,000 mailboxes) says a supplier invoice sent at 10:12 on Tuesday never arrived. A Smart Search on the message ID returns exactly one message: accepted at 10:12:44, verdict spam score 0, no policy rule fired, delivered to the Exchange hybrid connector at 10:12:47.
1,129 words, about 6 min