Incident responders determine that a company email server was the first compromised machine in an attack. The server was infected by malware. The following are abbreviated headers from three emails that the incident responders could not confidently determine to be safe:

Which of the following is the most likely reason the malware was delivered?

Question

Incident responders determine that a company email server was the first compromised machine in an attack. The server was infected by malware. The following are abbreviated headers from three emails that the incident responders could not confidently determine to be safe:

Which of the following is the most likely reason the malware was delivered?

Accepted Answer

B. The DMARC security check failed. A failed DMARC security check means the email's sender domain could not be authenticated according to its published policy, often indicating a spoofed email that could contain malware and bypass standard security controls.

Answer

A. An attachment scan could not be completed. An attachment scan failure would prevent the scan itself, but the question implies a broader email security check failure related to headers.

Answer

C. Repeated emails were sent from the same address. Repeated emails from the same address do not inherently indicate malware delivery, unless they are part of a phishing campaign that DMARC would ideally catch.

Answer

D. The SPF check failed. While SPF failing is a component of DMARC failure, DMARC encompasses the overall policy and action, making it a more comprehensive reason for a malicious email bypassing checks.

Incident responders determine that a company email server was the first compromised machine in an attack. The server was infected by malware. The following are abbreviated headers from three emails…

Question

Exhibits

Options

How the community answered

Why each option

Community Discussion