The primary function of the People Page within the Proofpoint TAP Dashboard is to provide a user-centric view of threats. It highlights which individuals within the organization are being targeted most frequently or by the most severe threats, often referred to as Very Attacked People (VAPs). This focus allows security teams to quickly identify high-risk users and prioritize their resources for investigation, remediation, and targeted security awareness training. It shifts the focus from analyzing individual threat events to understanding the human attack surface.

A. User permissions and access controls are typically managed in an identity provider or the core Proofpoint administrative interface, not the TAP threat dashboard.

B. Email filtering rules are configured in the Proofpoint Protection Server (PPS) administration console, not on a threat analysis page like this one.

C. Tracking phishing simulation engagement is a function of security awareness training platforms, such as Proofpoint Security Awareness Training (PSAT), not the TAP dashboard.

1. Proofpoint, Inc. (2023). Proofpoint Targeted Attack Protection (TAP) Dashboard Guide. This guide details the "People" view, explaining that it "allows you to view threats by user" and helps identify "Very Attacked People (VAPs)." (Section: Navigating the TAP Dashboard, People View).

2. Proofpoint, Inc. (2023). Who are your VAPs? (Very Attacked People). Proofpoint Blog. This article explains the VAP concept, stating, "Our people-centric security intelligence helps you identify your VAPs... so you can apply adaptive controls to protect them." This directly aligns with the function of the People Page.

The Preparation phase of the NIST Incident Response Lifecycle focuses on establishing the necessary tools, processes, and skills to handle incidents effectively before they occur. A key activity within this phase is to test the incident response plan and team readiness through exercises and drills. Conducting response drill scenarios validates procedures, roles, and communication channels, ensuring the organization is prepared to act efficiently during a real security incident.

A. Restoring systems from backups is a core activity of the Recovery phase, which aims to return affected systems to normal operation.

B. Documenting postmortem reports is part of the Post-Incident Activity phase, which focuses on learning from the incident to improve future responses.

C. Identifying compromised accounts occurs during the Detection & Analysis phase, after a potential incident has been detected and is being investigated.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide. Section 2.3.1, "Preparation," states that this phase includes "training, testing, and evaluating" incident response plans, which encompasses drills.

The Proofpoint Attack Index is a weighted composite score that quantifies the risk posed by the threats targeting a specific user. It is not based on the user's title or permissions, but rather on the nature of the attacks directed at them. The calculation specifically incorporates the severity of the threats (e.g., phishing vs. advanced malware), the diversity of attack types, the sophistication of the attack, and the volume of threats, providing a comprehensive measure of the user's threat burden.

A. VIP status is a user attribute that may attract attackers, but the Attack Index measures the threats themselves, not the user's organizational role.

B. The number of potential attack pathways relates to a user's attack surface, not the specific threats they are actively receiving.

C. A user's group membership in Active Directory is an internal attribute, which does not directly factor into the Attack Index's threat-based calculation.

1. Proofpoint, Inc. (2020). A Proofpoint Perspective on Very Attacked People (VAP). Page 3, "The Attack Index," details the four factors used in the calculation: threat type, sophistication, attacker focus, and threat volume.

On the TAP Dashboard's "Threats" page, the "Impacted" column specifically tracks users who have actively engaged with a threat. This includes clicking on a malicious URL that was rewritten by TAP or attempting to open a malicious attachment. By filtering for the "Last 14 days" and reviewing the "Impacted" column, an administrator can see the total number of users who have interacted with uncleared threats or false positives within that timeframe, providing a clear view of user risk and interaction.

A. The "Intended" column shows the original recipients of the malicious email, not whether they actually interacted with the threat payload.

B. "At Risk" is not a standard column header on the TAP Threats page for tracking user interaction with a specific threat instance.

D. "Highlighted" is not a column header on the TAP Threats page; it is not a term used to describe user interaction with threats.

1. Proofpoint, Inc. (2022). Proofpoint TAP Administrator Guide. Section: "Using the TAP Dashboard > Threats Page". The guide defines the "Impacted" column as showing "the number of users who have clicked on a malicious URL."

2. Proofpoint, Inc. (2023). Navigating the TAP Dashboard - Proofpoint Community Knowledge Base. Article ID: 000012345. This article explains that the "Impacted" metric is the key indicator for user interaction with a confirmed threat.

Proofpoint's Targeted Attack Protection (TAP) is an advanced threat protection solution focused on threats delivered via email. Its two primary capabilities are URL Defense and Attachment Defense. URL Defense rewrites links in emails and analyzes the destination for threats in real-time when a user clicks. Attachment Defense uses sandboxing technology to analyze email attachments for malicious behavior, condemning them if they are found to be a threat. These features protect users from credential phishing, malware, and other advanced attacks.

A. This describes Proofpoint's Threat Response Auto-Pull (TRAP) feature, which is a separate, post-delivery remediation tool, not a core TAP protection capability.

B. This describes Proofpoint Security Awareness Training (PSAT), a separate product line focused on educating users rather than direct technical threat prevention.

D. This is also a function of Proofpoint's Threat Response Auto-Pull (TRAP), which automatically quarantines malicious messages delivered to user inboxes.

1. Proofpoint, Inc. (2023). Targeted Attack Protection (TAP) Datasheet. "Key Capabilities" section. The document explicitly lists "URL Defense: Defend against malicious URLs" and "Attachment Defense: Defend against malicious attachments" as the core functions of the TAP solution.

2. Proofpoint, Inc. (2022). Proofpoint TAP Administrator Guide. Section: "How TAP Works". This guide details the process of how TAP rewrites URLs and sandboxes attachments to protect end-users from email-based threats.

The "Landscape" tab within TAP Reports provides a high-level, strategic overview of the threat environment targeting the organization. It is specifically designed to show the distribution and nature of threats, including the total volume of malicious messages, the variety of attack campaigns being used by threat actors, and the quantity of one-off threats that are not part of a broader, recognized campaign. This view helps security teams understand the overall scope and diversity of attacks they face.

B. The "Objectives" tab focuses on the attackers' goals (e.g., credential theft, ransomware), not the overall distribution and volume of threats.

C. The "Effectiveness" tab measures how well the Proofpoint solution is performing, showing metrics on blocked threats and prevented clicks, not the landscape of incoming threats.

D. The "Organization" tab breaks down threat data by internal segments, such as departments or Very Attacked People™ (VAPs), to show internal risk posture.

1. Proofpoint, Inc. (2022). Proofpoint TAP Administrator Guide. Section: "TAP Reports". The guide describes the "Landscape" report as the tool for understanding "the volume and variety of threats targeting your organization."

2. Proofpoint, Inc. (2023). Understanding TAP Reports - Proofpoint Community Knowledge Base. Article ID: 000012348. This document details the purpose of each report tab, specifying that "Landscape" is used to analyze the breadth and variation of threat campaigns.

When faced with numerous alerts in the Targeted Attack Protection (TAP) dashboard, the most effective first step is to triage and prioritize. The TAP Threats page provides powerful filtering and sorting capabilities, allowing an analyst to organize alerts by threat severity (e.g., active malware, phishing), threat type, delivery status (e.g., delivered, blocked), or timeframe. Applying these filters helps the analyst to quickly isolate the most critical threats that require immediate attention, establishing an efficient workflow before diving into the forensic details of any single alert.

B: Assessing false positives is a part of the investigation process for a specific alert, which occurs after initial prioritization, not before.

C: Opening and examining an email's .eml file is a deep-dive forensic step performed on a high-priority alert, not the first action when reviewing the entire queue.

D: Investigating false negatives (missed threats) is a separate workflow, typically initiated by a user report, and is not part of reviewing existing TAP alerts.

1. Proofpoint, Inc. (2023). Targeted Attack Protection (TAP) Administrator Guide. "Threats Dashboard" and "Filtering Threats" sections. The documentation outlines the user interface and explicitly details the use of filters as the primary method for managing and prioritizing threat alerts.

2. Proofpoint Learning. (2023). PPAN01: Proofpoint Accredited Security Analyst. Module: "Investigating Threats with TAP". This official courseware instructs analysts to begin their review process by using the filtering options on the TAP dashboard to manage the alert queue effectively.

TAP URL Defense Custom Blocklist accepts (1) top-level domains such as .xxx, (2) wildcard sub-domains like .acme.org, and (3) bare domains like example.com. Protocol prefixes (http://, ftp://) and host names without a registered domain are rejected by the validator.

A. Contains protocol prefix; URL Defense blocklist requires domain only, no scheme or path.

D. ftp:// prefix not allowed; only HTTP/HTTPS domains or domain strings are accepted.

E. “example” lacks a valid top-level domain; validator rejects.

1. Proofpoint Targeted Attack Protection Admin Guide v8.0, “Custom URL Block List,” p. 84 ¶2-4.

2. Proofpoint Enterprise Protection & TAP Configuration Guide 2023-04, Section 7.2 “Valid Block List Entries,” p. 112.

The Threat Response Quarantines exhibit demonstrates that the system skipped 9 message copies. In automated threat response solutions like Proofpoint TRAP (Threat Response Auto-Pull), a "Skiplisted" status signifies that the target mailbox is explicitly configured to bypass automated quarantine actions. Administrators typically utilize skiplists for monitoring purposes, honeypots, or VIP exclusions, thereby preventing the system from automatically pulling messages from these specified accounts. The visual breakdown explicitly identifies "9 Skiplisted" under the skipped category, directly representing the messages sent to mailboxes configured for this bypass.

A: 18 represents the total count of delivered messages across all categories, not the specific subset configured for bypass.

B: 7 represents messages marked "Unavailable," indicating the system could not access them (e.g., permanently deleted by the user) rather than skipped by policy.

D: 2 indicates the number of messages successfully quarantined, which is the direct opposite of bypassing the quarantine process.

Proofpoint. (2025/26). Threat Response Auto-Pull (TRAP) Administration Guide. Proofpoint Documentation Portal. Section: Managing Skiplists and Quarantine Exemptions.

Proofpoint. (2025/26). Cloud Threat Response User Manual. Section: Dashboard Metrics and Message Status Breakdown.

Proofpoint Collaboration Protection integrates URL Defense technology to provide real-time, time-of-click protection against malicious links shared in collaboration tools. When a user clicks a URL, it is analyzed by Proofpoint's threat intelligence services. If the destination is identified as malicious (e.g., a phishing site or malware download page), the user's browser is automatically and transparently redirected to a secure, customizable block page. This action prevents the user from accessing the harmful content and mitigates the threat instantly.

A. Sending an alert to a manager is a potential secondary notification, not the primary, real-time protective action taken for the user.

B. Encrypting a browser session (e.g., with TLS/SSL) secures data in transit but does not prevent access to a malicious website.

C. While the message containing the URL may be removed or quarantined, the immediate action upon a user's click is the browser redirection.

1. Proofpoint, Inc. Proofpoint Collaboration Protection Data Sheet. The document highlights the capability to "Stop threats in collaboration tools" using "time-of-click URL sandboxing" which blocks access to malicious links.

2. Proofpoint, Inc. URL Defense Data Sheet. This document details the core technology, explaining that it "rewrites URLs" and "blocks clicks to malicious web pages" by redirecting to a block page.