A security analyst is working on a suspicious email forwarded from a user. The email contains an attachment asking the user to open it. Which of the following should the security analyst review to bes

The correct answer is A. DMARC. DMARC results in the email headers show whether the message passed or failed authentication checks such as SPF and DKIM. Reviewing these results helps determine whether the sender was spoofed and provides insight into the likely origin of the attack.

Submitted by kavita_s· Mar 6, 2026Security operations

Question

A security analyst is working on a suspicious email forwarded from a user. The email contains an attachment asking the user to open it. Which of the following should the security analyst review to best determine email authentication and its attack origin?

Options

ADMARC
BSMTP
CJoe Sandbox
DURL rewriting

How the community answered

(45 responses)

A
89% (40)
B
2% (1)
C
2% (1)
D
7% (3)

Explanation

DMARC results in the email headers show whether the message passed or failed authentication checks such as SPF and DKIM. Reviewing these results helps determine whether the sender was spoofed and provides insight into the likely origin of the attack.

Topics

#DMARC#email authentication#attack origin#email security

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice