Proofpoint Email Security Specialist study plan
Proofpoint Email Security Specialist · Give each week a clear focus.
8 weeks · About 7 hours per week
Email Security Fundamentals
Map the full inbound and outbound message flow (SMTP ingress, filtering stages, policy evaluation, delivery or quarantine) and draw it from memory by end of week.
Define the core email components (MTA, MDA, MUA, relay, gateway, spam quarantine, smart host) and explain where a secure email gateway sits in each path.
Explain the difference between connection-level, envelope-level, header-level, and content-level filtering and give one control example for each.
Identify the major email attack categories (phishing, spear phishing, business email compromise, malware delivery, credential harvesting, spam, graymail) and describe the observable signal each leaves in a message.
Write a one-paragraph summary of how a secure email gateway differs from native cloud mailbox filtering and when an organization layers both.
Your checkpoint
A hand-drawn or digital message-flow diagram with every filtering stage labeled, plus a one-page glossary of at least 20 email security terms written in your own words.
Threat Detection and Classification
Trace how a message is scored and classified (reputation, content analysis, sender/recipient history, URL and attachment inspection) and list what happens at each verdict threshold.
Compare static signature detection with dynamic sandbox detonation and state two strengths and two blind spots of each.
Describe how URL rewriting and time-of-click analysis defend against delayed or weaponized links, and identify the log evidence each produces.
Build a taxonomy of attachment-based threats (macro documents, archive files, ISO and disk images, HTML smuggling, LNK files) and note the detection lever for each.
Explain impersonation and display-name spoofing detection and how it differs from domain-level authentication failure.
Your checkpoint
A classification cheat sheet covering at least 8 threat types with the detection signal, the likely verdict, and the analyst action for each.
Threat Detection and Classification & Policy, Rules and Filtering Configuration
Reconstruct how a message travels through policy evaluation order and explain why rule precedence changes the final verdict.
Draft at least 6 filtering rules covering sender, recipient, subject, attachment type, URL reputation, and content keywords, and predict the outcome for a sample message against each.
Explain allowlists, blocklists, and safe/blocked sender lists, and describe the risk of over-broad allowlisting.
Design a quarantine and hold policy with thresholds for spam, bulk, phishing, and malware, and justify each action.
Describe how content disarmament and attachment sandboxing policies are scoped and where they can break legitimate business mail.
Your checkpoint
A written rule set of at least 6 rules in evaluation order, each with condition, action, expected outcome, and a noted false-positive risk.
Email Authentication (SPF, DKIM, DMARC)
Explain SPF mechanics (DNS TXT record, authorized senders, the 10-DNS-lookup limit, qualifiers) and construct a valid record for a domain with two sending sources.
Explain DKIM signing and verification (selector, key pair, canonicalization, body hash) and identify what a DKIM pass does and does not prove.
Explain DMARC alignment (relaxed vs strict), policy values, reporting addresses, and how pct and subdomain policy affect enforcement.
Diagnose three common authentication failure scenarios (forwarding breaks SPF, third-party sender unsigned, alignment mismatch) and propose a fix for each.
Interpret an aggregate DMARC report and identify which sending sources are failing alignment.
Your checkpoint
A domain authentication worksheet containing a sample SPF record, DKIM selector plan, DMARC record at p=none then p=quarantine, and a written remediation plan for three failing sending sources.
Email Authentication (SPF, DKIM, DMARC) & Message Tracking, Quarantine and Incident Response
Describe how authentication results feed filtering decisions and where a DMARC fail should escalate to quarantine versus reject.
Walk through message tracking from sender to final disposition and list the fields you would inspect first when a user reports a missing message.
Explain quarantine release, message release approval, and end-user spam digest workflows, including who should hold release rights.
Outline an incident response sequence for a confirmed phishing campaign: scope, contain, purge, notify, and remediate.
Identify the evidence to preserve (headers, URLs, attachment hashes, recipient list) and how to search for all recipients of a campaign.
Your checkpoint
A message-tracking trace of one real or simulated message from ingress to disposition, plus a one-page phishing incident response runbook with five phases.
Message Tracking, Quarantine and Incident Response & Email Security Fundamentals
Practice reading full message headers to extract sending IP, authentication results, relay chain, and originating domain.
Build a search strategy to find all instances of a campaign by subject, sender, URL, or attachment hash and confirm the result set is complete.
Execute a simulated purge and release exercise and document the audit trail each action produces.
Explain user reporting add-ins and how reported messages feed tuning and false-negative analysis.
Review a false-positive case end to end and describe how to adjust policy without opening a broad gap.
Your checkpoint
An annotated header analysis of two messages (one malicious, one false positive) with a written tuning recommendation for each.
Administration, Reporting and Platform Operations & Policy, Rules and Filtering Configuration
Describe role-based administration, least privilege, and separation between policy authoring and message release.
Explain how to stage a policy change safely: test scope, pilot group, rollback plan, and change documentation.
Identify the reports and metrics that matter (detection rates, false-positive rate, quarantine volume, top targeted users, authentication pass rates) and what each reveals.
Configure and interpret an alert for a spike in a specific verdict or a new sending source.
Explain how to export and retain logs for audit and how retention windows affect investigation.
Your checkpoint
A one-page operations dashboard spec listing at least 6 metrics, the data source for each, and the alert threshold you would set.
Email Security Fundamentals & Threat Detection and Classification & Policy, Rules and Filtering Configuration & Email Authentication (SPF, DKIM, DMARC) & Message Tracking, Quarantine and Incident Response & Administration, Reporting and Platform Operations
Complete a timed 60-question mixed practice set and score each miss by domain to find residual weak areas.
Re-teach the two weakest domains from your own notes without opening reference material.
Re-derive the SPF, DKIM, and DMARC records and the rule evaluation order from memory.
Review every missed question and write the corrected reasoning for each.
Run a final 30-minute rapid review of the glossary, cheat sheet, and runbook.
Your checkpoint
A scored practice result with a per-domain breakdown and a written list of no more than 5 remaining weak points with the action to close each before exam day.
Milestones
Week 2: Can explain the message flow and every filtering stage from memory, and correctly classify 8 threat types with their detection signal.
Week 4: Can construct valid SPF, DKIM, and DMARC records for a multi-sender domain and explain alignment failure without notes.
Week 6: Can trace a message end to end, read a full header, and execute a scoped purge and release with a documented audit trail.
Week 8: Scores at least 80% on the mixed practice set with no domain below 70%, and has a written plan for the remaining weak points.