Email Header Analysis and Authentication DFE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common sign of email header forgery?

   • AThe Date header is within a few minutes of the Received headers
   • BThe Received headers show a path that is inconsistent with the originating domain
   • CThe Received headers are in chronological order from bottom to top
   • DThe Message-ID header contains the sender's domain
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a DMARC policy, what does the 'p=quarantine' directive instruct receiving mail servers to do with messages that fail authentication?

   • AEncrypt the message before delivery
   • BDeliver the message normally
   • CReject the message and return it to the sender
   • DDeliver the message to the spam folder
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is configuring email authentication for a domain. The goal is to prevent attackers from spoofing the domain in phishing emails. Which protocol should be configured to tell receiving mail servers what to do with messages that fail SPF and DKIM checks?

   • ADKIM
   • BSPF
   • CDMARC
   • DTLS
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You are evaluating an email that has the following Authentication-Results header: Authentication-Results: mx.example.com; spf=pass smtp.mailfrom=example.com; dkim=pass header.d=example.net; dmarc=fail (p=reject) header.from=example.com What is the most likely reason for the DMARC failure?

   • ASPF passed, but DKIM failed because the d= domain is example.net.
   • BThe DMARC policy is p=reject, so DMARC always fails.
   • CSPF passed, but the envelope sender domain (example.com) is not aligned with the From domain (example.com).
   • DDKIM passed, but the d= domain (example.net) is not aligned with the From domain (example.com).
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An email from your domain shows 'spf=fail' in the Authentication-Results header, but the email was sent from your legitimate mail server. Which of the following is the most likely cause?

   • AThe SPF record does not include the IP address of your mail server.
   • BThe email was sent from a different domain's server.
   • CThe email was sent with a forged Return-Path.
   • DThe receiving server does not support SPF.
   Reveal Solution Discussion Select an answer first