CS0-003 · Question #483
A security analyst reviews a SIEM alert related to a suspicious email and wants to verify the authenticity of the message: SPF = PASS DKIM = FAIL DMARC = FAIL Which of the following did the analyst…
The correct answer is B. The message was sent from an authorized mail server but was not signed. The SPF = PASS result confirms the email came from an authorized server, but DKIM = FAIL indicates the message was not properly signed with the expected DomainKeys Identified Mail (DKIM) signature. DMARC = FAIL suggests that because DKIM failed, the overall email authentication…
Question
A security analyst reviews a SIEM alert related to a suspicious email and wants to verify the authenticity of the message:
SPF = PASS DKIM = FAIL DMARC = FAIL Which of the following did the analyst most likely discover?
Options
- AAn insider threat altered email security records to mask suspicious DNS resolution traffic.
- BThe message was sent from an authorized mail server but was not signed.
- CLog normalization corrupted the data as it was brought into the central repository.
- DThe email security software did not process all of the records correctly.
How the community answered
(27 responses)- A4% (1)
- B81% (22)
- C4% (1)
- D11% (3)
Explanation
The SPF = PASS result confirms the email came from an authorized server, but DKIM = FAIL indicates the message was not properly signed with the expected DomainKeys Identified Mail (DKIM) signature. DMARC = FAIL suggests that because DKIM failed, the overall email authentication failed. This scenario is consistent with a legitimate server sending an unsigned
Topics
Community Discussion
No community discussion yet for this question.