Email Header Analysis and Authentication DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is reviewing headers of an email that claims to be from the CEO. The Received chain shows the message entered the company's mail server from an IP in a foreign country, but the From header displays the CEO's address. The Message-ID was generated by the foreign mail server. Which finding most strongly indicates header forgery?

   • AThe From header matches the CEO's address
   • BThe Message-ID was generated by a foreign server
   • CThe Received chain and the From header are inconsistent with the CEO's normal sending pattern
   • DThe Received chain shows the email entered from a foreign IP
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which email header field is used to store a unique identifier for the message, which can help correlate related messages and detect certain types of forgery?

   • AMIME-Version
   • BReturn-Path
   • CReceived
   • DMessage-ID
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of DMARC alignment?

   • ATo compare the Message-ID with the From header
   • BTo verify that the domain in the From header matches the domain used in SPF or DKIM authentication
   • CTo ensure the message is encrypted
   • DTo check that the recipient's email server is authorized
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An email is received with an SPF result of 'pass'. What does this indicate?

   • AThe sending server's IP address is listed in the SPF record of the envelope sender's domain
   • BThe From header domain matches the envelope sender domain
   • CThe message content has not been altered
   • DThe message was encrypted during transit
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A security team is implementing email authentication for a domain that sends a high volume of legitimate email through a third-party marketing service. The team wants to ensure that emails from the marketing service are authenticated, but they also want to avoid rejecting legitimate emails if the marketing service occasionally changes its sending IPs. Which approach best balances security and deliverability?

   • AUse a strict SPF record with -all and require the marketing service to update the record for every IP change
   • BUse only SPF with a softfail (~all) and no DMARC
   • CUse DKIM for the marketing service and set a DMARC policy of p=none initially, then move to quarantine after monitoring
   • DUse DMARC with p=reject immediately to ensure maximum security
   Reveal Solution Discussion Select an answer first