During an investigation, you are building a timeline of a suspect's activities. You have email headers showing that a suspicious email was sent at 10:00 UTC, and the suspect's computer logs show a login at 09:55 UTC. What can you infer from this correlation?

The suspect likely sent the email from their computer because the login time is close to the email send time.

The email was sent from a different device because the login time is before the email time.

The email is unrelated to the suspect's activities.

The suspect definitely sent the email because they were logged in at the time.

During an investigation, you examine an email that claims to be from a bank. The SPF check shows 'pass' and the DKIM signature is valid. However, the DMARC policy in the domain's DNS is set to 'none'. What is the most accurate conclusion about this email's authenticity?

The email is definitely spoofed because DMARC is not set to reject.

The email is invalid because DMARC must be set to 'quarantine' for authentication to work.

The email is likely legitimate, but DMARC 'none' means no action is taken on failures, so it could still be spoofed.

The email is definitively from the bank because SPF and DKIM both passed.

You are analyzing an email file (.eml) and need to determine the original sender's IP address. Which header field is most likely to contain this information?

The 'Received' header from the first hop.

GIAC Certified Forensic Examiner

Domain 6Objective 3

Email Analysis GCFE Practice Questions (Page 6)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 26–30

26application · medium
During an investigation, you are building a timeline of a suspect's activities. You have email headers showing that a suspicious email was sent at 10:00 UTC, and the suspect's computer logs show a login at 09:55 UTC. What can you infer from this correlation?
Select an answer first
27application · medium
During an investigation, you examine an email that claims to be from a bank. The SPF check shows 'pass' and the DKIM signature is valid. However, the DMARC policy in the domain's DNS is set to 'none'. What is the most accurate conclusion about this email's authenticity?
Select an answer first
28application · medium
You are analyzing an email file (.eml) and need to determine the original sender's IP address. Which header field is most likely to contain this information?
Select an answer first
29foundation · easy
Which email authentication mechanism publishes a policy in DNS that instructs receiving mail servers on how to handle messages that fail SPF or DKIM checks?
Select an answer first
30foundation · easy
When building a timeline of user activity, which email header field provides the most reliable timestamp for when the message was originally composed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Email Analysis GCFE Practice Questions (Page 6)

Questions 26–30

During an investigation, you are building a timeline of a suspect's activities. You have email headers showing that a suspicious email was sent at 10:00 UTC, and the suspect's computer logs show a login at 09:55 UTC. What can you infer from this correlation?

During an investigation, you examine an email that claims to be from a bank. The SPF check shows 'pass' and the DKIM signature is valid. However, the DMARC policy in the domain's DNS is set to 'none'. What is the most accurate conclusion about this email's authenticity?

You are analyzing an email file (.eml) and need to determine the original sender's IP address. Which header field is most likely to contain this information?

Which email authentication mechanism publishes a policy in DNS that instructs receiving mail servers on how to handle messages that fail SPF or DKIM checks?

When building a timeline of user activity, which email header field provides the most reliable timestamp for when the message was originally composed?

Keep studying — User and Cloud Artifacts