Which of the following is MOST helpful in determining whether a phishing email is malicious?

The correct answer is C. Threat intelligence. Threat intelligence (C) is most helpful because it provides context about known malicious senders, domains, URLs, and attack patterns - allowing analysts to compare email indicators against established threat feeds and databases to confirm whether a phishing attempt is malicious.

Submitted by minji_kr· Apr 18, 2026Information Security Incident Management

Question

Options

ASecurity awareness training
BReverse engineering
CThreat intelligence
DSandboxing

How the community answered

(39 responses)

A
5% (2)
B
13% (5)
C
56% (22)
D
26% (10)

Explanation

Threat intelligence (C) is most helpful because it provides context about known malicious senders, domains, URLs, and attack patterns - allowing analysts to compare email indicators against established threat feeds and databases to confirm whether a phishing attempt is malicious.

Why the distractors are wrong:

A (Security awareness training) teaches users to recognize phishing but doesn't help determine if a specific email is malicious - it's preventive, not analytical.
B (Reverse engineering) is used to dissect malware binaries, not to evaluate email legitimacy.
D (Sandboxing) is useful for safely executing suspicious attachments/links, but it analyzes payloads - not the email itself - and is a step that comes after suspicion is already established.

Memory tip: Think of threat intelligence as a "criminal database lookup" - you're checking the email's fingerprints (sender IP, domain, URLs) against known bad actors. The other options are either training tools (A), malware analysis techniques (B, D), or act too late in the process.

Topics

#Phishing detection#Threat intelligence#Email security#Security operations

Community Discussion

No community discussion yet for this question.

Full CISM Practice