サンプル問題 1： An analyst has been tasked with providing a report that can be used to prioritise investigations based on a user's Attack Index score. Which report would be most suitable for this purpose?
A: VIP Activity
B: Top 10 Recipients
C: Very Attacked People
D: Top 10 Clickers
正解：C
Explanation: Attack Index is a user-level risk/burden metric intended to help SOC teams prioritize which people to investigate first based on the amount and severity/diversity of threat activity directed at them (and often their exposure/interaction, depending on module). The report that directly supports that workflow is “Very Attacked People,” which is designed to surface users with the highest Attack Index and concentration of targeted threats. Operationally, this aligns with IR queue management: instead of treating all alerts equally, analysts use user-centric risk ranking to focus on likely compromise candidates (e.g., frequent recipients of credential phishing, repeated exposure to the same campaign, or elevated threat severity). “Top 10 Recipients” is volume-oriented and may include benign bulk mail; “Top 10 Clickers” is behavior-oriented but does not necessarily reflect overall threat burden; and “VIP Activity” is scoped to a subset (VIPs) rather than the complete organization’s risk ranking. In Proofpoint-led IR best practice, this report is commonly used to drive daily standups, assign investigations, and justify proactive account checks (MFA posture, suspicious logins, mailbox rules) for the highest-risk users.
サンプル問題 2： What is the first action a security analyst should take when beginning to review and prioritize alerts from Targeted Attack Protection (TAP)?
A: Use filtering options on the TAP Threats page to organize and prioritize threat alerts.
B: Assess claims of false positives by analyzing forensic details and threat indicators.
C: Open and examine the contents of an email using the associated .eml file.
D: Investigate false negatives by identifying root causes in source policy configurations.
正解：A
Explanation: The first step in a scalable TAP-driven workflow is to reduce the alert set into an actionable queue using built-in filtering on the Threats page (time range, severity, threat type, campaign grouping, Intended/At Risk/Impacted, VIP targeting, and “Highlighted” categories). This aligns with SOC operational procedures: triage is a funnel, and TAP’s dashboards are optimized for sorting by risk and user impact so analysts can quickly identify what is most likely to represent an active incident. Jumping straight into .eml review or false-positive adjudication is inefficient before you know which threats have user interaction (clicks), broad distribution, or high severity. Likewise, false-negative root cause analysis is a later-stage improvement activity, typically triggered after an incident or quality review. In Proofpoint IR practice, you filter first to find: (1) threats with “Impacted” users (clicks/interaction), (2) high severity (credential theft/malware), (3) VIP targeting, and (4) campaign clusters. Only then do you pivot into forensic details, message artifacts, URL/attachment detonation results, and―if necessary―remediation actions (blocklists, TRAP pulls, user resets).
サンプル問題 3： What best describes the nature of the NIST incident response lifecycle?
A: A cyclical process focused on continuous improvement.
B: A linear process from detection to recovery.
C: A reactive-only approach to cyber threats.
D: A one-time checklist for handling incidents.
正解：A
Explanation: NIST SP 800-61 defines incident response as an iterative lifecycle―Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident Activity―where outputs from each incident are fed back into strengthening controls and readiness. In Proofpoint-focused IR, this cyclical nature is especially visible because email/social engineering threats evolve continuously and defenders must tune controls over time. For example, a credential phishing incident may drive updates to TAP/TRAP workflows (auto-pull policies, detection rules), user coaching (ZenGuide “Report Suspicious” adoption), and hardening changes (DMARC enforcement, MFA policy, OAuth app governance). Post-incident metrics (time-to-detect, time-to-quarantine, click rate, submission-to-verdict time) become inputs for improving alerting, triage filters, and escalation criteria. Proofpoint platforms also support retroactive actions (e.g., post-delivery quarantine), which encourages a “detect, respond, learn, and reduce recurrence” loop. Treating IR as linear or one-time fails in practice because threat actors retool rapidly, and organizations must continuously refine technical controls, playbooks, and human processes to maintain resilience.
