Which statement about how impersonation analysis identifies spoofed email addresses is correct?

Question

Options

• AIt uses behavior analysis to detect spoofed addresses.
• BIt uses DMARC validation to detect spoofed addresses.
• CIt maps the display name to the correct recipient email address
• DIt uses SPF validation to detect spoofed addresses.

• A
  3% (1)
• B
  90% (36)
• C
  3% (1)
• D
  5% (2)

Explanation

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the protocol specifically designed for impersonation analysis - it validates that the "From" domain in an email matches authenticated sending infrastructure by checking both SPF and DKIM records, then enforcing a policy (none/quarantine/reject) when they don't align, which is exactly how spoofed sender addresses are detected.

Why the distractors are wrong:

• A (behavior analysis) - Behavior analysis detects anomalies in patterns (e.g., unusual login times), not spoofed addresses directly; that's a different security layer.
• C (maps display name to recipient) - This gets the direction backwards; impersonation analysis maps the display name to the sender's legitimate domain, not the recipient's address.
• D (SPF validation) - SPF is a component that DMARC uses, but SPF alone only checks the envelope sender (MAIL FROM), not the visible "From" header that users see - so it's incomplete for impersonation detection without DMARC tying it together.

Memory tip: Think "DMARC = Domain Armor" - it's the umbrella framework that combines SPF and DKIM to protect the domain, making it the correct answer whenever a question asks about detecting spoofed addresses holistically. If you see "impersonation" or "spoofed From address," go straight to DMARC over SPF alone.

No community discussion yet for this question.