Email Header Analysis and Authentication DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   You are analyzing an email header that contains the following Authentication-Results line: Authentication-Results: mx.example.com; spf=pass smtp.mailfrom=example.com; dkim=pass header.d=example.com; dmarc=pass (p=reject, sp=reject) header.from=example.com Which conclusion is correct?

   • AThe email passed all three checks and is likely legitimate.
   • BThe email is spoofed because the SPF and DKIM domains are the same.
   • CThe email passed SPF but failed DKIM because the d= domain is different.
   • DThe email failed DMARC because the policy is p=reject.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You are investigating an email that has a valid DKIM signature, but the body of the email appears to have been altered after it was sent. What is the most likely explanation?

   • AThe DKIM signature is invalid because the body was altered.
   • BThe body was altered after the signature was generated, but the signature was not updated.
   • CThe email was modified in transit, but the DKIM signature was re-signed by a relay server.
   • DThe DKIM signature was not applied to the body, only to headers.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which field within a Received header typically contains the IP address of the server that sent the message to the receiving server?

   • Aby
   • Bfor
   • Cfrom
   • Dwith
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's domain has the following DMARC record: v=DMARC1; p=reject; rua=mailto:dmarc@example.com An email is sent from a server not listed in the SPF record, and the DKIM signature is invalid. What will a receiving mail server that supports DMARC do with this email?

   • AAccept it because the DKIM signature is invalid but SPF is not checked
   • BQuarantine it because the policy is reject
   • CDeliver it to the inbox because DMARC is not required
   • DReject it because the DMARC policy is reject
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are analyzing an email that appears to be from a bank. The Received headers show a path that goes through a server in a foreign country, but the bank's legitimate mail servers are in your country. What is the most likely conclusion?

   • AThe email is definitely legitimate because the Received headers are consistent.
   • BThe email is legitimate because it passed through a foreign server.
   • CThe email is definitely spoofed because the path is unusual.
   • DThe email is likely spoofed or relayed through an unauthorized server.
   Reveal Solution Discussion Select an answer first