Which of the following is a sign of email spoofing?

The 'From' address does not match the 'Return-Path' or the domain in the Received headers

The email contains a large attachment

The email was sent during business hours

The email has a valid digital signature

You are analyzing a suspicious email. The headers show the following: 'Received: from mail.attacker.com (203.0.113.5) by mail.victim.com with ESMTP; ...' and 'From: ceo@victim.com'. The SPF record for victim.com does not include 203.0.113.5. However, the email passed DKIM verification. What is the most likely explanation?

The email is legitimate because DKIM passed.

The SPF record is misconfigured and the email is actually legitimate.

The email is spoofed, but the attacker also controls the DKIM signing domain.

The email was sent from a compromised server within victim.com.

You are performing passive reconnaissance on a target domain. The Whois record shows that the registrant's email address is redacted, but the registrar is 'Example Registrar Inc.' and the creation date is 2015. Which approach would most likely reveal the actual registrant's identity?

Sending an email to the domain's administrative contact

Searching historical Whois records from third-party archives

Performing a DNS zone transfer to obtain the registrant's email

Querying the registrar's Whois server directly for the domain

EC-CouncilCertified Ethical Hacker

Domain 2Objective 2

Whois, DNS and Email Footprinting CEH Practice Questions (Page 6)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

11concepts

Questions 26–30

26foundation · easy
Which email header field typically contains the subject of the email?
Select an answer first
27foundation · easy
Which DNS record type maps a domain name to an IPv6 address?
Select an answer first
28foundation · easy
Which of the following is a sign of email spoofing?
Select an answer first
29expert · hard
You are analyzing a suspicious email. The headers show the following: 'Received: from mail.attacker.com (203.0.113.5) by mail.victim.com with ESMTP; ...' and 'From: ceo@victim.com'. The SPF record for victim.com does not include 203.0.113.5. However, the email passed DKIM verification. What is the most likely explanation?
Select an answer first
30application · medium
You are performing passive reconnaissance on a target domain. The Whois record shows that the registrant's email address is redacted, but the registrar is 'Example Registrar Inc.' and the creation date is 2015. Which approach would most likely reveal the actual registrant's identity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Whois, DNS and Email Footprinting CEH Practice Questions (Page 6)

Questions 26–30

Which email header field typically contains the subject of the email?

Which DNS record type maps a domain name to an IPv6 address?

Which of the following is a sign of email spoofing?

You are performing passive reconnaissance on a target domain. The Whois record shows that the registrant's email address is redacted, but the registrar is 'Example Registrar Inc.' and the creation date is 2015. Which approach would most likely reveal the actual registrant's identity?

Keep studying — Reconnaissance Techniques