// PATH EXAM

🎣 Phishing & email

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. What does SPF check? Which servers may send mail for the envelope (Return-Path) domain That the message body was not modified in transit That the visible From domain is what it claims to be That the mail travels encrypted

2. A domain publishes "v=DMARC1; p=none; rua=mailto:…". What happens to a mail spoofing its From? Its sender is rewritten It always goes to the spam folder It is delivered normally: p=none only asks for reports It is rejected

3. Which header shows the SPF, DKIM and DMARC results computed by the receiving server? Authentication-Results X-Mailer Reply-To Message-ID

4. Why is looking at the sender’s display name ("Bank X") not enough? Because the antivirus changes it on arrival Because the display name is always fake Because it is only shown on mobile Because anyone can set any name: what counts is the address and the authenticated domain

5. What does "-all" at the end of an SPF record mean? That any server is authorised That any server not in the list must fail SPF That the result is neutral That the receiver must ignore SPF

6. What does DMARC do that SPF and DKIM do not do on their own? Require the domain authenticated by SPF or DKIM to match the visible From domain, and say what to do if it does not Encrypt the connection between servers Sign every message Block dangerous attachments

7. What is DMARC "relaxed" alignment? That any domain is accepted That the policy becomes p=none That DKIM is not needed That matching the organisational domain is enough (mail.example.com aligns with example.com)

8. What does DKIM provide? A signature over headers and body that the receiver checks with a public key published in DNS The policy for what to do with failing mail A list of the IPs allowed to send End-to-end encryption of the message