Proofpoint Email Security Specialist study guide
Proofpoint Email Security Specialist · Work through your exam, one topic at a time.
This page is an independent study guide for the Proofpoint Email Security Specialist credential. It is written for email administrators, security engineers and SOC analysts who configure and operate Proofpoint email protection day to day, and for candidates who want a structured way to revise before sitting an exam. The Proofpoint Email Security Specialist study guide has 8 sections and about 2,010 words.
01Email Security Fundamentals
Domain 1 tests how mail actually moves through Proofpoint Email Protection and where inspection, policy, and authentication fit. Expect questions on the SMTP envelope versus message headers, inbound and outbound paths, gateway placement, and the difference between spam, bulk email, phishing, malware, and business email compromise (BEC).
288 words, about 1 min02Threat Detection and Classification
Domain 2 tests how Proofpoint classifies inbound messages and why a verdict is spam, phishing, malware, bulk, or impostor/BEC. Expect questions on Targeted Attack Protection (TAP), URL Defense, Attachment Defense, sandbox detonation, click-time protection, and quarantine versus delivery with a banner.
258 words, about 1 min03Policy, Rules and Filtering Configuration
Domain 3 tests policy routes, rules, filters, conditions, actions, and evaluation order. Expect questions on scoping rules to sender or recipient groups, content filters, DLP, encryption, hold and quarantine actions, and why one rule beats another.
269 words, about 1 min04Email Authentication (SPF, DKIM, DMARC)
Domain 4 tests SPF, DKIM, and DMARC mechanics and how Proofpoint displays and enforces results. Expect questions on alignment, qualifiers, DNS lookup limits, selector lookup, aggregate reports, and policy actions.
244 words, about 1 min05Message Tracking
Domain 5 tests how to trace a message through Proofpoint and interpret the result. Expect questions on search filters, Message-ID, envelope versus header addresses, timestamps, quarantine, rule hits, and delivery status.
250 words, about 1 min06Quarantine and Incident Response
Domain 6 tests quarantine handling and incident response after a bad message is delivered. Expect questions on admin and end-user quarantine, release, delete, Threat Response Auto-Pull (TRAP), retroactive remediation, and containment steps.
238 words, about 1 min07Administration
Domain 7 tests administration of the Proofpoint platform: roles, org hierarchy, settings inheritance, connectors, directory sync, audit, and licensing. Expect questions on least privilege, delegated administration, and change control.
229 words, about 1 min08Reporting and Platform Operations
Domain 8 tests reporting and day-to-day platform operations. Expect questions on scheduled reports, dashboards, syslog and API export, health monitoring, capacity, and using metrics to tune policy.
234 words, about 1 min