An analyst is reviewing the Authentication-Results header of an email: Authentication-Results: mx.receiver.com; spf=pass (receiver.com: domain of sender.com designates 203.0.113.5 as permitted sender) smtp.mailfrom=sender.com; dkim=pass header.d=sender.com; dmarc=pass (p=reject, sp=reject) header.from=sender.com What can the analyst conclude about this email?

The email passed SPF but failed DKIM

The email is authentic and was sent from an authorized server for sender.com

The email failed DMARC because the policy is reject

The email is spoofed because the From header is sender.com

A domain owner has set the following DMARC record: v=DMARC1; p=quarantine; pct=50 An email from this domain fails both SPF and DKIM. What will a receiving server that supports DMARC do with this email?

Quarantine it 50% of the time and deliver the rest to the inbox

Deliver it to the inbox because DMARC is optional

Reject it because the policy is quarantine

Quarantine it always because the policy is quarantine

EC-CouncilDigital Forensics Essentials

Domain 6Objective 4

Email Header Analysis and Authentication DFE Practice Questions (Page 3)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

40questions here

8free pages

8concepts

Questions 11–15

11application · medium
An analyst is reviewing the Authentication-Results header of an email: Authentication-Results: mx.receiver.com; spf=pass (receiver.com: domain of sender.com designates 203.0.113.5 as permitted sender) smtp.mailfrom=sender.com; dkim=pass header.d=sender.com; dmarc=pass (p=reject, sp=reject) header.from=sender.com What can the analyst conclude about this email?
Select an answer first
12application · medium
A user received a suspicious email. The analyst opens the full headers and sees the following Received chain (top to bottom): Received: from mail.attacker.com (mail.attacker.com [203.0.113.10]) by mx.contoso.com Received: from mail.contoso.com (mail.contoso.com [192.0.2.5]) by mail.attacker.com Received: from [10.0.0.7] (unknown [198.51.100.77]) by mail.contoso.com The analyst wants to identify the originating IP address of the email. Which IP should be reported as the source?
Select an answer first
13foundation · easy
In an email message, which part of the header contains the routing information added by each mail server that handles the message?
Select an answer first
14application · medium
A domain owner has set the following DMARC record: v=DMARC1; p=quarantine; pct=50 An email from this domain fails both SPF and DKIM. What will a receiving server that supports DMARC do with this email?
Select an answer first
15application · medium
A forensic examiner is analyzing an email header and wants to distinguish between the envelope sender and the message header From address. Which field in the email header represents the envelope sender?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Email Header Analysis and Authentication DFE Practice Questions (Page 3)

Questions 11–15

In an email message, which part of the header contains the routing information added by each mail server that handles the message?

A domain owner has set the following DMARC record: v=DMARC1; p=quarantine; pct=50 An email from this domain fails both SPF and DKIM. What will a receiving server that supports DMARC do with this email?

A forensic examiner is analyzing an email header and wants to distinguish between the envelope sender and the message header From address. Which field in the email header represents the envelope sender?

Keep studying — Dark Web and Email Forensics