A security analyst must review a suspicious email to determine its legitimacy. Which of the following should be performed? (Choose two.)

Scoring fields like SCL and BCL are heuristic scores from email filters, which indicate spam likelihood but don't provide definitive technical proof of legitimacy or malicious intent.

Reviewing the full, original headers of an email, especially if it was forwarded, reveals crucial technical details about its routing, sender, and intermediate servers, helping to uncover spoofing or tampering that isn't visible in the display-from address.

Examining only the recipient address field does not provide information about the legitimacy of the sender or the authenticity of the email's origin.

The Content-Type header specifies the format of the email body, which is important for rendering but not a direct indicator of the email's legitimacy or malicious nature.

While the HELO or EHLO string can sometimes reveal suspicious mail server behavior, SPF, DKIM, and DMARC provide more comprehensive and reliable authentication checks for sender legitimacy.

SPF, DKIM, and DMARC are email authentication protocols designed to verify the sender's identity and detect email spoofing. Examining these fields in the email headers provides definitive technical evidence of whether the sender domain is authorized to send that email, which is critical for determining legitimacy.