When tracing the origin of an email, which Received header should be examined first to identify the most recent server that handled the message?

The bottom-most Received header

The Received header that contains the sender's domain

The Received header with the earliest timestamp

An analyst is examining an email that appears to be from a colleague. The Received headers show the email was sent from an IP address that is not in the company's known range, but the From header is the colleague's address. The Message-ID is in the format of an external service. Which of the following is the most reliable indicator that the email is spoofed?

The combination of an external IP and an external Message-ID with a company From address

The From header matches the colleague's address

The Received headers show an IP outside the company's range

The Message-ID is from an external service

Where does a receiving mail server obtain the public key needed to verify a DKIM signature?

From the From header of the email

From a DNS TXT record at the selector._domainkey.

You are examining an email with a DKIM signature. The signature is valid, but the 'From' header was not included in the signed headers. What is the implication?

The email is definitely spoofed because From is not signed.

The DKIM signature is invalid because From must be signed.

The From header could have been modified after signing without invalidating the DKIM signature.

The DKIM signature covers the entire email body and all headers.

EC-CouncilDigital Forensics Essentials

Domain 6Objective 4

Email Header Analysis and Authentication DFE Practice Questions (Page 1)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

40questions here

8free pages

8concepts

Questions 1–5

1foundation · easy
When tracing the origin of an email, which Received header should be examined first to identify the most recent server that handled the message?
Select an answer first
2application · medium
An analyst is examining an email that appears to be from a colleague. The Received headers show the email was sent from an IP address that is not in the company's known range, but the From header is the colleague's address. The Message-ID is in the format of an external service. Which of the following is the most reliable indicator that the email is spoofed?
Select an answer first
3foundation · easy
Where does a receiving mail server obtain the public key needed to verify a DKIM signature?
Select an answer first
4foundation · easy
Which DNS record type is used to publish an SPF policy for a domain?
Select an answer first
5application · medium
You are examining an email with a DKIM signature. The signature is valid, but the 'From' header was not included in the signed headers. What is the implication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Email Header Analysis and Authentication DFE Practice Questions (Page 1)

Questions 1–5

When tracing the origin of an email, which Received header should be examined first to identify the most recent server that handled the message?

Where does a receiving mail server obtain the public key needed to verify a DKIM signature?

Which DNS record type is used to publish an SPF policy for a domain?

You are examining an email with a DKIM signature. The signature is valid, but the 'From' header was not included in the signed headers. What is the implication?

Keep studying — Dark Web and Email Forensics