Quarantine and Incident Response
Domain 6 tests quarantine handling and incident response after a bad message is delivered. Expect questions on admin and end-user quarantine, release, delete, Threat Response Auto-Pull (TRAP), retroactive remediation, and containment steps.
Core rules
- Quarantine holds messages for review; release can re-evaluate or bypass filters depending on configuration.
- TRAP can pull messages already delivered to mailboxes after a verdict changes.
- Incident response follows identify, contain, purge, reset credentials, notify, and document.
- Release only after confirming the message is safe; a clean re-scan is not a guarantee.
- End-user quarantine digests reduce admin load but require clear release policy and user guidance.
Worked example
A credential-phishing campaign reached 40 inboxes. TAP identifies the cluster, TRAP pulls the messages, and the team blocks the URL and sender domain. Because two users clicked, force password resets and revoke sessions, then send a targeted notice. Releasing the original message would undo containment and expose users again.
Traps that cost marks
Releasing without purging other copies; pulling only by subject; skipping credential reset after a click; failing to record scope; and treating a quarantine release as remediation when the message was already delivered.