Which element in this email is an indicator of attack?
A.
IP Address: 202.142.155.218
B.
content-Type: multipart/mixed
C.
attachment: “Card-Refund”
D.
subject: “Service Credit Card”
The Answer Is:
C
This question includes an explanation.
Explanation:
According to the Cisco Certified CyberOps Associate guide (Chapter 5 - Identifying Attack Methods), attachments in emails—especially with file extensions like .xlsm—are high-risk indicators when analyzing suspicious or phishing emails. Malicious actors often use macro-enabled Excel files (.xlsm) as a payload delivery mechanism for malware or other exploits. These attachments are typically disguised as legitimate content such as refunds or invoices to trick the recipient into opening them.
The presence of “Card_Refund_18_6913.xlsm” is a strong Indicator of Compromise (IoC), as .xlsm files can contain VBA macros capable of executing malicious code. This matches exactly with examples provided in the study material discussing how macro-based payloads are delivered and recognized.
Hence, option C is the most direct indicator of attack in this email.
300-215 PDF/Engine
Printable Format
Value of Money
100% Pass Assurance
Verified Answers
Researched by Industry Experts
Based on Real Exams Scenarios
100% Real Questions
Get 65% Discount on All Products,
Use Coupon: "ac4s65"