Question 1
When analyzing an email for phishing indicators, which header field most reliably reveals the actual sending mail server's IP address?
Correct Answer:
Received:
Question 2
An email passes SPF checks but fails DMARC. Which scenario best explains this?
Correct Answer:
The email was sent from an authorized IP but the From: domain does not align with the SPF-authenticated domain.
Question 3
A SOC analyst receives a suspicious email with a URL: https://paypa1-secure.login.example.com/verify. What phishing technique does this URL demonstrate?
Correct Answer:
Subdomain spoofing using a trusted brand keyword
Question 4
Which tool is specifically designed to detonate suspicious email attachments in an isolated environment to observe malicious behavior without risking production systems?
Correct Answer:
Any.run or Cuckoo Sandbox
Question 5
During phishing triage, an analyst finds the sender domain was registered 2 days ago. Why is this significant?
Correct Answer:
A very low domain age is a strong indicator of a throwaway phishing domain.
Question 1
Exam overview

About this Exam

Prepare with the PSAA Practice Questions - Practical SOC Analyst Associate (PSAA) Exam practice quiz. This question bank includes 100 questions covering analyst, alert, suspicious, windows, and email. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

PSAA Practice Questions - Practical SOC Analyst Associate (PSAA) Exam

This practice set contains 100 questions from the matching question bank and focuses on analyst, alert, suspicious, windows, and email. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions