A security analyst reviews a SIEM alert related to a suspicious email and wants to...

CompTIA CS0-003 Question Answer

A security analyst reviews a SIEM alert related to a suspicious email and wants to verify the authenticity of the message:

SPF = PASS

DKIM = FAIL

DMARC = FAIL

Which of the following did the analyst most likely discover?

An insider threat altered email security records to mask suspicious DNS resolution traffic.

The message was sent from an authorized mail server but was not signed.

Log normalization corrupted the data as it was brought into the central repository.

The email security software did not process all of the records correctly.

CompTIA CS0-003 Summary

Price: $52.5 ~~$149.99~~