300-720 · Question #35
An analyst creates a new content dictionary to use with Forged Email Detection. Which entry will be added into the dictionary?
The correct answer is B. Alpha Beta. For Forged Email Detection, the content dictionary must contain display names (friendly names) of legitimate internal senders - for example, 'Alpha Beta' (B). The feature works by comparing the From: header display name in an incoming message against the dictionary. If the…
Question
An analyst creates a new content dictionary to use with Forged Email Detection. Which entry will be added into the dictionary?
Exhibit
Options
- Amycompany.com
- BAlpha Beta
- C^Alpha\ Beta$
- D[email protected]
How the community answered
(33 responses)- A3% (1)
- B85% (28)
- C3% (1)
- D9% (3)
Explanation
For Forged Email Detection, the content dictionary must contain display names (friendly names) of legitimate internal senders - for example, 'Alpha Beta' (B). The feature works by comparing the From: header display name in an incoming message against the dictionary. If the display name matches an entry but the actual email address does not belong to your organization, the message is flagged as forged. You do not enter domains (A), regex patterns (C), or full email addresses (D) into this dictionary - only the plain display names of people whose identities attackers might impersonate.
Topics
Community Discussion
No community discussion yet for this question.