An organization uses Microsoft 365 and a user's mailbox is involved in a litigation hold. During an investigation, you need to produce a complete record of all email messages sent and received by that user, including messages that were deleted from the Deleted Items folder. Which approach is the most appropriate to collect this data while preserving the integrity of the original mailbox?

Ask the user to forward all relevant emails to the investigator.

Log into the user's mailbox with their credentials and export the contents to a PST file.

Use the Exchange Management Shell to run 'New-MailboxExportRequest' to export the mailbox to a PST.

Use the Microsoft 365 Purview compliance portal to perform an eDiscovery search and export the results.

An analyst is examining a suspicious email that contains a link. The email's headers show it passed SPF and DKIM. The link in the email points to 'http://example.com/update' but the actual URL in the HTML source is 'http://example.com/update@evil.com'. What is the most likely explanation for this discrepancy?

The email is legitimate and the link is a typo.

The link is broken and will not work.

The email is safe because SPF and DKIM passed.

The email is likely malicious because the visible text and the actual href point to different domains.

GIAC Certified Forensic Examiner

Domain 6Objective 3

Email Analysis GCFE Practice Questions (Page 3)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 11–15

11foundation · easy
Which email header field is most commonly used by an investigator to identify the sender's claimed address, which may be spoofed?
Select an answer first
12application · medium
You are analyzing an email file (.eml) recovered from a suspect's drive. You need to determine the exact time the message was composed by the sender, not just when it was received by the mail server. Which header field should you examine?
Select an answer first
13expert · hard
An organization uses Microsoft 365 and a user's mailbox is involved in a litigation hold. During an investigation, you need to produce a complete record of all email messages sent and received by that user, including messages that were deleted from the Deleted Items folder. Which approach is the most appropriate to collect this data while preserving the integrity of the original mailbox?
Select an answer first
14application · medium
An analyst is examining a suspicious email that contains a link. The email's headers show it passed SPF and DKIM. The link in the email points to 'http://example.com/update' but the actual URL in the HTML source is 'http://example.com/update@evil.com'. What is the most likely explanation for this discrepancy?
Select an answer first
15foundation · easy
In an email header, which field is used to trace the actual path a message took from the sender's mail server to the recipient's mailbox?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Email Analysis GCFE Practice Questions (Page 3)

Questions 11–15

Which email header field is most commonly used by an investigator to identify the sender's claimed address, which may be spoofed?

You are analyzing an email file (.eml) recovered from a suspect's drive. You need to determine the exact time the message was composed by the sender, not just when it was received by the mail server. Which header field should you examine?

In an email header, which field is used to trace the actual path a message took from the sender's mail server to the recipient's mailbox?

Keep studying — User and Cloud Artifacts