CS0-002 Exam - Question 37

Question

A security analyst inspects the header of an email that is presumed to be malicious and sees the following:

Which of the following is inconsistent with the rest of the header and should be treated as suspicious?

Examice · Accepted Answer

The sender's email address is suspicious. The email header shows that the email was received from 'sonic306-20.navigator.mail.company.com', which does not correspond to the yahoo.com domain of the sender's email address (smith@yahoo.com). This inconsistency is a common indicator of email spoofing or other malicious activity.

Laudy · Answer

Its B, but it was sent by "sonic306-20.navigator.mail.company.com", not yahoo.
The google server is to be expected since "to" is a gmail.com email. (It's like by-direction-of)
Just check your own gmail headers.

anon0621 · Answer

The sender is yahoo but the header indicates google

amateurguy · Answer

I say B

R00ted · Answer

B is the correct answer

2Fish · Answer

B.  The From and "received from" domains do not match.

sorinttt · Answer

unbelievable what a lack of attention on your part! Sonic306 is not an email address but a server through which the email passed, if you have GMAIL, open an email and look in the header.

Received: from mail1.static.mailgun.info (mail1.static.mailgun.info. [104.130.122.1])
         by mx.google.com with UTF8SMTPS id r9-20020a05622a034900b003f52c2fa74dsi4072172qtw.146.2023.05.22.09.48.04
         for <[email protected]>

CS0-002 Exam - Question 37

Discussion