Threat Detection and Classification
Domain 2 tests how Proofpoint classifies inbound messages and why a verdict is spam, phishing, malware, bulk, or impostor/BEC. Expect questions on Targeted Attack Protection (TAP), URL Defense, Attachment Defense, sandbox detonation, click-time protection, and quarantine versus delivery with a banner.
Classification signals
- Reputation of sender IP, domain, and URL; authentication results; header anomalies; content; attachment type; and user engagement.
- URL Defense rewrites links and checks at click time, so a message can be clean at delivery and malicious later.
- Attachment Defense detonates suspicious files; sandbox verdicts include malicious, suspicious, clean, and inconclusive.
- TAP focuses on targeted phishing, credential theft, and zero-day malware, not just high-volume spam.
- Confidence matters: a low-confidence verdict may justify a banner or subject tag rather than quarantine.
Worked example
A PDF attachment contains a link to a newly registered domain. Static scanning finds no exploit, but detonation shows a credential-harvesting page. Classify as phishing with a malicious URL, quarantine the message, and block or rewrite the URL. Do not release it because the PDF itself "looks clean"-the payload is the link.
Traps that cost marks
Treating all phishing as malware; trusting a display name; releasing a message after URL reputation changes; ignoring inconclusive sandbox results; and assuming a clean attachment scan covers embedded links.