You are analyzing a suspicious email that contains a link. The link appears to point to a legitimate website, but the actual URL is obfuscated. Which technique is most effective for determining the true destination of the link without clicking it?

Check the email's SPF and DKIM records.

Use a URL shortener service to expand the link.

Perform a DNS lookup on the domain in the link.

Examine the email's HTML source code to see the anchor tag's href attribute.

An email security analyst is reviewing a suspicious email that claims to be from a well-known online retailer. The email's DKIM signature is valid, but the SPF check fails. The DMARC policy for the retailer's domain is p=reject. What is the most likely outcome when the email was received by the mail server?

The email was rejected because DMARC p=reject and SPF failed, assuming no DKIM alignment.

The email was quarantined because DMARC p=reject is not enforced.

The email was delivered because SPF failure is not fatal.

The email was delivered because DKIM passed.

You are investigating a phishing email that contains a malicious attachment. The attachment is a .docm file. Which of the following is the most important step to take when analyzing this attachment?

Extract the macros and analyze them in a sandbox environment.

Open the attachment in a word processor to see what it does.

Check the email's SPF and DKIM records to determine if the attachment is malicious.

Delete the attachment without analysis.

During a forensic examination of a suspect's hard drive, you find remnants of an email in unallocated space. The email appears to have been deleted from an Outlook PST file. You need to recover the email content and metadata. Which approach is most likely to yield the best results?

Run a simple file recovery tool to undelete the PST file.

Use a forensic tool that can carve email fragments from unallocated space based on known email headers and MIME structures.

Search the unallocated space for the string 'Subject:' and manually reconstruct the email.

Restore the PST file from a backup and analyze it.

GIAC Certified Forensic Examiner

Domain 6Objective 3

Email Analysis GCFE Practice Questions (Page 5)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 21–25

21application · medium
You are analyzing a suspicious email that contains a link. The link appears to point to a legitimate website, but the actual URL is obfuscated. Which technique is most effective for determining the true destination of the link without clicking it?
Select an answer first
22application · medium
You are analyzing an email file (.eml) recovered from a suspect's drive. You need to determine the IP address of the computer that sent the email. Which header field is most likely to contain this information?
Select an answer first
23application · medium
An email security analyst is reviewing a suspicious email that claims to be from a well-known online retailer. The email's DKIM signature is valid, but the SPF check fails. The DMARC policy for the retailer's domain is p=reject. What is the most likely outcome when the email was received by the mail server?
Select an answer first
24expert · hard
You are investigating a phishing email that contains a malicious attachment. The attachment is a .docm file. Which of the following is the most important step to take when analyzing this attachment?
Select an answer first
25expert · hard
During a forensic examination of a suspect's hard drive, you find remnants of an email in unallocated space. The email appears to have been deleted from an Outlook PST file. You need to recover the email content and metadata. Which approach is most likely to yield the best results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Email Analysis GCFE Practice Questions (Page 5)

Questions 21–25

You are analyzing a suspicious email that contains a link. The link appears to point to a legitimate website, but the actual URL is obfuscated. Which technique is most effective for determining the true destination of the link without clicking it?

You are analyzing an email file (.eml) recovered from a suspect's drive. You need to determine the IP address of the computer that sent the email. Which header field is most likely to contain this information?

You are investigating a phishing email that contains a malicious attachment. The attachment is a .docm file. Which of the following is the most important step to take when analyzing this attachment?

During a forensic examination of a suspect's hard drive, you find remnants of an email in unallocated space. The email appears to have been deleted from an Outlook PST file. You need to recover the email content and metadata. Which approach is most likely to yield the best results?

Keep studying — User and Cloud Artifacts