// PATH EXAM

🎣 Phishing & email

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. Which header shows the SPF, DKIM and DMARC results computed by the receiving server? Reply-To X-Mailer Message-ID Authentication-Results

2. A link shows "https://mybank.com" but points to "https://mybank.com.secure-login.xyz/login". Which domain is the page on? mybank.com None: it is an IP address secure-login.xyz (mybank.com is just one of its subdomains) Just .xyz

3. A mail arrives with the attachment "invoice.pdf.exe". What does it indicate? A compressed PDF A digitally signed PDF A double extension to hide an executable Nothing: it is a common invoice format

4. At most how many DNS lookups can evaluating an SPF record trigger? 5 10 As many as needed 20

5. What does "-all" at the end of an SPF record mean? That the receiver must ignore SPF That any server not in the list must fail SPF That the result is neutral That any server is authorised

6. A domain publishes "v=DMARC1; p=none; rua=mailto:…". What happens to a mail spoofing its From? Its sender is rewritten It is delivered normally: p=none only asks for reports It is rejected It always goes to the spam folder

7. What is the recommended way to reach p=reject without losing legitimate mail? Publish p=reject straight away and fix things as they come Turn DKIM off until the end Remove SPF in the meantime Start at p=none with reports, authenticate every legitimate sender and move up in phases

8. What is DMARC "relaxed" alignment? That the policy becomes p=none That matching the organisational domain is enough (mail.example.com aligns with example.com) That DKIM is not needed That any domain is accepted