CHFI Email and Social Media Forensics

Question 1

Which email header field is most important for tracing the originating IP address of an email message?

Accepted Answer

Received

Answer

From

Answer

Reply-To

Answer

Message-ID

Question 2

In email forensics, what does the 'X-Originating-IP' header reveal?

Accepted Answer

The IP address of the client that originally submitted the email

Answer

The destination mail server IP

Answer

The DNS server IP used for delivery

Answer

The antivirus scanner IP

Question 3

Which tool is commonly used by CHFI investigators to analyze email headers and trace email origins?

Accepted Answer

MXToolbox Email Header Analyzer

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 4

What is the forensic significance of the MIME (Multipurpose Internet Mail Extensions) structure in email investigation?

Accepted Answer

It encodes attachments and multi-part content that may contain embedded malware or evidence

Answer

It defines email routing rules

Answer

It encrypts email body content

Answer

It authenticates sender domains

Question 5

Which email authentication mechanism adds a digital signature to outgoing emails that can be verified to confirm the sender's domain integrity?

Accepted Answer

DKIM

Answer

SPF

Answer

DMARC

Answer

MX record

Question 6

During an email forensics investigation, what does a missing or broken DMARC alignment indicate?

Accepted Answer

The email may be a phishing attempt or spoofed to impersonate a legitimate domain

Answer

The email was encrypted end-to-end

Answer

The email was sent via a mobile device

Answer

The email server is overloaded