When filtering for threats on the TAP People page, which two filters have the highest chance of finding compromises? (Select two.)

On the TAP People page, the goal is to find users who are most likely compromised. "Exposure > Delivered with Accessible Threat" (C) filters for users who received a malicious email that was not condemned and whose malicious URL is still live, representing a direct and present danger. "Exposure > Permitted Clicks" (A) filters for users who clicked a sandboxed URL that an administrator subsequently deemed safe and allowed. This action carries a high risk of compromise if the admin's assessment was incorrect or the site was compromised post-analysis. Both filters pinpoint users with the highest probability of a successful compromise.

B. "Users > Locations" is a demographic filter used for geographic analysis of threats and does not, by itself, indicate a user compromise.

D. "Threats > False Positives Only" is used to review and manage items that were incorrectly flagged as threats, which is the opposite of finding actual compromises.

E. "Users > VIP" filters for a high-value target group but does not inherently mean those users have been compromised; it only indicates they are frequently targeted.

1. Proofpoint, Inc. (2023). Targeted Attack Protection (TAP) Administrator Guide. Section: "Investigating People." The guide describes the filters available on the People page, highlighting the risk associated with "Permitted Clicks" and "Delivered Threats" as key indicators for investigation.

2. Proofpoint, Inc. (2023). Navigating the TAP Dashboard. Knowledge Base Article #KB6754. This article explains the meaning of different exposure metrics, noting that "Permitted Clicks" and threats that remain "Accessible" require immediate attention from security teams as they represent significant risk.