// PATH EXAM

🎣 Phishing & email

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. What does SPF check? That the visible From domain is what it claims to be That the message body was not modified in transit Which servers may send mail for the envelope (Return-Path) domain That the mail travels encrypted

2. Why is looking at the sender’s display name ("Bank X") not enough? Because anyone can set any name: what counts is the address and the authenticated domain Because the display name is always fake Because it is only shown on mobile Because the antivirus changes it on arrival

3. A mail arrives with the attachment "invoice.pdf.exe". What does it indicate? A double extension to hide an executable Nothing: it is a common invoice format A digitally signed PDF A compressed PDF

4. What does DMARC do that SPF and DKIM do not do on their own? Encrypt the connection between servers Block dangerous attachments Require the domain authenticated by SPF or DKIM to match the visible From domain, and say what to do if it does not Sign every message

5. At most how many DNS lookups can evaluating an SPF record trigger? 20 10 As many as needed 5

6. What is DMARC "relaxed" alignment? That any domain is accepted That DKIM is not needed That the policy becomes p=none That matching the organisational domain is enough (mail.example.com aligns with example.com)

7. Which header shows the SPF, DKIM and DMARC results computed by the receiving server? Reply-To Message-ID Authentication-Results X-Mailer

8. A domain publishes "v=DMARC1; p=none; rua=mailto:…". What happens to a mail spoofing its From? It always goes to the spam folder It is delivered normally: p=none only asks for reports Its sender is rewritten It is rejected