I85PREP
⌘ K
CC-CEM study materials
CC-CEM study resources

CC-CEM practice questions

One question at a time. Build your CC-CEM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Email Architecture and Deployment Models

In a cloud email deployment, which component is primarily responsible for enforcing policies such as DLP and transport rules on messages while they are in transit within the provider's environment?

  1. The mail transport or routing layer Correct answer.
  2. The mailbox store cluster
  3. The directory synchronization agent
  4. The client access front end

Explanation

Transport and routing layers inspect messages as they flow between senders, recipients, and the internet, so policy enforcement such as DLP and transport rules happens there. The mailbox store persists delivered items, while client access and directory sync do not sit in the message path in the same way.

Question 2Cloud Email Architecture and Deployment Models

An organization wants mailboxes hosted in the cloud while keeping an on-premises directory as the authoritative source of user accounts. Which identity model best matches this requirement?

  1. Hybrid identity with synchronized accounts and on-premises authority Correct answer.
  2. Federated identity with directory synchronization
  3. Cloud-only identity with no on-premises directory
  4. Guest-only identity with external accounts

Explanation

Hybrid identity synchronizes on-premises directory objects to the cloud while keeping the on-premises directory authoritative for account attributes and lifecycle. Cloud-only identity removes the on-premises source, and guest accounts are for external collaboration rather than employee mailboxes.

Question 3Cloud Email Architecture and Deployment Models

Which DNS record type must be published so that external senders can locate the cloud email service's inbound mail servers for a domain?

  1. An MX record pointing to the provider's mail exchange host Correct answer.
  2. A TXT record at the root of the domain
  3. A CNAME record aliasing the domain to the provider's website
  4. An SRV record for the submission service

Explanation

MX records tell sending mail systems which hosts accept mail for the domain, and cloud migrations require updating them to the provider's exchange hosts. TXT records carry policy and verification data, CNAME aliases web or autodiscover names, and SRV records are not used for SMTP delivery routing.

Question 4Cloud Email Architecture and Deployment Models

What is the primary purpose of a connector that routes outbound mail from a cloud email tenant through an on-premises smart host?

  1. To replicate calendar free/busy data to the on-premises organization
  2. To direct outbound traffic through a controlled egress point for filtering or compliance Correct answer.
  3. To encrypt messages between the cloud tenant and the smart host with TLS
  4. To synchronize mailbox permissions between environments

Explanation

Outbound connectors let an organization send cloud-originated mail through an on-premises or third-party smart host, giving a controlled egress point for filtering, logging, or compliance inspection. TLS settings may be configured on the connector but encryption is not its defining purpose, and permissions or free/busy replication are unrelated.

Question 5Cloud Email Architecture and Deployment Models

Which statement best describes the difference between a cloud-only mailbox deployment and a hybrid deployment?

  1. Cloud-only deployments cannot use directory synchronization of any kind.
  2. Cloud-only deployments host all mailboxes in the cloud, while hybrid deployments split mailboxes between cloud and on-premises. Correct answer.
  3. Hybrid deployments require all mailboxes to remain on-premises permanently.
  4. Hybrid deployments eliminate the need for any on-premises infrastructure.

Explanation

The defining distinction is mailbox placement: cloud-only puts all mailboxes in the service, whereas hybrid keeps some mailboxes on-premises and some in the cloud with shared routing and namespace. Hybrid still relies on on-premises servers for synchronization and mail flow, and cloud-only deployments can still synchronize directory data.

Question 6Cloud Email Architecture and Deployment Models

A company plans a cutover migration from an on-premises email system to a cloud service for about 150 users in a single weekend. Which characteristic makes cutover appropriate here?

  1. It permanently preserves on-premises routing for selected users.
  2. It supports coexistence with rich calendar sharing for months.
  3. It moves all mailboxes in one coordinated batch with a short coexistence window. Correct answer.
  4. It requires per-user staged batches spread across several weeks.

Explanation

Cutover migration is designed for smaller environments where all mailboxes move together in one operation with minimal coexistence. Staged and hybrid approaches are used when long coexistence, selective batches, or rich cross-premises features are required.

Question 7Cloud Email Architecture and Deployment Models

Which record type is used to publish a DKIM public key so that receiving systems can verify signatures on mail sent from a domain?

  1. An MX record on the selector name
  2. A PTR record for the sending IP address
  3. A TXT record at the selector hostname Correct answer.
  4. An A record at the domain apex

Explanation

DKIM publishes the public key in a TXT record at a selector-based name such as selector._domainkey.example.com, which receivers query to validate the signature. MX records define mail exchangers, A records map hostnames to addresses, and PTR records provide reverse DNS for IP addresses.

Question 8Cloud Email Architecture and Deployment Models

In a cloud email architecture, what role does a client access layer typically play for mobile and desktop clients?

  1. It stores the authoritative copy of each mailbox database.
  2. It terminates client protocol sessions and proxies or routes them to mailbox services. Correct answer.
  3. It relays outbound SMTP to external recipients.
  4. It performs directory synchronization with on-premises systems.

Explanation

The client access layer accepts protocols such as MAPI, IMAP, POP, and ActiveSync and routes or proxies client sessions to the appropriate mailbox back end. Mailbox storage, directory synchronization, and outbound SMTP relay are handled by other architectural components.

Question 9Cloud Email Architecture and Deployment Models

An administrator must keep an on-premises email server available after a hybrid deployment so that certain attributes can still be written back to the cloud. Which component enables this write-back capability?

  1. The hybrid mail flow connector
  2. The mailbox retention policy
  3. The autodiscover record
  4. The directory synchronization engine with write-back configured Correct answer.

Explanation

Directory synchronization tools can be configured for write-back so that changes made on-premises, or certain cloud-originated values, flow back to the authoritative on-premises directory. Connectors handle mail routing, autodiscover locates services, and retention policies govern message lifecycle.

Question 10Cloud Email Architecture and Deployment Models

After moving mailboxes to the cloud, users report that messages from an external partner are being rejected with an SPF failure. The domain's SPF record still lists only the legacy on-premises sending IP. What is the most appropriate remediation?

  1. Publish a DKIM key without changing the SPF record.
  2. Remove the SPF record entirely to stop the rejection.
  3. Add the cloud service's sending infrastructure to the SPF record and keep authorized legacy senders. Correct answer.
  4. Change the MX record to point to the partner's mail server.

Explanation

SPF authorizes specific sending infrastructure, so cloud-originated mail fails until the provider's sending hosts are included in the SPF record. Removing SPF removes authorization entirely, DKIM alone does not fix an SPF alignment failure, and MX records govern inbound routing rather than outbound authorization.

Question 11Cloud Email Architecture and Deployment Models

A company wants cloud mailboxes to coexist with on-premises mailboxes and share a single SMTP namespace so that internal mail routes correctly in both directions. Which configuration is essential?

  1. Removing all on-premises mail flow servers
  2. A shared namespace with connectors and directory synchronization between environments Correct answer.
  3. Disabling autodiscover for cloud users
  4. Separate unrelated SMTP domains for each environment

Explanation

Hybrid coexistence requires a shared namespace, directory synchronization for a common address list, and connectors that route mail between the cloud and on-premises organizations. Separate domains break the unified namespace, autodiscover must remain available, and on-premises transport is needed for routing.

Question 12Cloud Email Architecture and Deployment Models

Which migration approach is best suited when an organization needs to move mailboxes in scheduled batches over several weeks while preserving coexistence with on-premises users throughout?

  1. PST export and import
  2. IMAP migration
  3. Cutover migration
  4. Staged migration Correct answer.

Explanation

Staged migration moves mailboxes in controlled batches over time, which supports coexistence during a longer transition. Cutover moves everything at once, IMAP migration is limited in fidelity and coexistence, and PST export/import is a manual data transfer rather than a coexistence-capable migration method.

Question 13Cloud Email Architecture and Deployment Models

An organization wants to ensure that mail leaving its cloud tenant is inspected by an on-premises data loss prevention appliance before reaching the internet. Which architecture supports this requirement?

  1. Create a shared mailbox on the appliance
  2. Enable autodiscover to point clients at the appliance
  3. Route outbound mail through an on-premises smart host using an outbound connector Correct answer.
  4. Publish an MX record pointing to the DLP appliance for inbound mail only

Explanation

An outbound connector can direct cloud-originated mail to an on-premises smart host, allowing the DLP appliance to inspect and relay it before internet delivery. MX records affect inbound routing, autodiscover locates client services, and shared mailboxes do not intercept outbound transport.

Question 14Cloud Email Architecture and Deployment Models

Which consideration most directly affects the choice between a single-region and a multi-region cloud email deployment for a global workforce?

  1. Data residency requirements and user latency to mailbox services Correct answer.
  2. The frequency of directory synchronization cycles
  3. The number of accepted domains configured in the tenant
  4. The retention period applied to deleted items

Explanation

Regional placement is driven primarily by legal or regulatory data residency obligations and by network latency between users and their mailbox services. Domain count, retention settings, and sync frequency influence administration but are not the primary drivers of regional architecture.

Question 15Cloud Email Architecture and Deployment Models

What is the function of an accepted domain configured as an internal relay domain in a cloud email tenant?

  1. It converts the domain into an alias for the primary domain.
  2. It accepts mail for the domain and relays messages for unknown recipients to another system. Correct answer.
  3. It authorizes outbound sending only for that domain.
  4. It rejects all mail for the domain at the edge.

Explanation

An internal relay domain lets the cloud service accept mail for the namespace and forward messages addressed to recipients it does not host to another mail system. Authoritative domains deliver to hosted mailboxes, and relay domains do not authorize outbound sending or act as aliases.

Question 16Cloud Email Architecture and Deployment Models

A user's mailbox is in the cloud, but their calendar free/busy information must be shared with on-premises users. Which mechanism most commonly enables this cross-premises availability?

  1. An SMTP connector dedicated to calendar traffic
  2. An autodiscover CNAME record
  3. A public folder replicated to the cloud
  4. Federated sharing or an availability service configured between the environments Correct answer.

Explanation

Cross-premises free/busy relies on an availability service or federation trust that lets each environment query the other for calendar data. SMTP connectors carry mail, public folders are a separate data store, and autodiscover only helps clients locate services.

Question 17Cloud Email Architecture and Deployment Models

An organization is evaluating a cloud email provider's SLA and discovers it offers a 99.9 percent monthly uptime commitment. What does this commitment typically cover?

  1. Guaranteed delivery of every message within one minute
  2. Immunity from all planned maintenance windows
  3. Service availability of the mailbox and access endpoints during the billing month Correct answer.
  4. Full replacement of lost mailbox data without backup

Explanation

Uptime SLAs generally measure availability of the service endpoints over a defined period, with service credits if the target is missed. They do not guarantee per-message delivery latency, replace customer backup responsibilities, or exempt all maintenance.

Question 18Cloud Email Architecture and Deployment Models

Which statement accurately describes the relationship between an on-premises email server and a cloud tenant in a hybrid deployment's mail routing?

  1. The on-premises server only handles inbound internet mail and never sends to the cloud.
  2. Both environments route mail to each other using connectors and shared addressing. Correct answer.
  3. Mail routing between environments requires disabling directory synchronization.
  4. The cloud tenant routes all internal mail without consulting on-premises routing.

Explanation

Hybrid routing is bidirectional: connectors and shared addressing allow each environment to deliver mail to recipients in the other. On-premises servers still handle their mailboxes and internet flow, and directory synchronization is required for hybrid coexistence rather than being disabled.

Question 19Cloud Email Architecture and Deployment Models

A security team wants to prevent spoofing of a domain that does not send any email at all. Which DNS configuration is most appropriate?

  1. Publish an MX record pointing to a null host
  2. Publish an SPF record of -all and a DMARC policy of reject for the domain Correct answer.
  3. Publish a wildcard A record for all subdomains
  4. Publish only a DKIM key with no SPF or DMARC record

Explanation

For a domain that sends no mail, an SPF record ending in -all plus a DMARC policy of reject instructs receivers to reject unauthorized mail claiming to be from the domain. A DKIM key alone does not block spoofing, a null MX only affects inbound delivery, and wildcard A records do not express mail authentication policy.

Question 20Cloud Email Architecture and Deployment Models

An administrator needs to verify that directory changes made on-premises for a user's proxy addresses appear in the cloud tenant within a predictable interval. Which factor most directly determines that interval?

  1. The autodiscover refresh interval on the client
  2. The outbound connector's TLS settings
  3. The directory synchronization schedule and change detection configuration Correct answer.
  4. The mailbox retention policy applied to the user

Explanation

Attribute propagation depends on how often directory synchronization runs and how it detects changes. Retention policies govern message lifecycle, autodiscover refresh affects client endpoint discovery, and connector TLS settings affect transport security rather than directory replication timing.

Question 21Cloud Email Architecture and Deployment Models

A multinational firm must keep mailbox data for European employees within the European Union while allowing administrators in another region to manage the tenant. Which architectural approach addresses this requirement?

  1. Replicating all mailboxes to every region for redundancy
  2. A single global tenant with all mailboxes placed in a non-EU region
  3. Storing all mailboxes on-premises and using no cloud services
  4. A multi-region tenant with EU mailboxes provisioned in an EU region and delegated administration Correct answer.

Explanation

Data residency is satisfied by provisioning mailboxes in a region that meets the legal requirement while central administration is delegated across regions. Placing EU mailboxes outside the EU violates residency, abandoning cloud services avoids the requirement rather than meeting it, and replicating everywhere would spread data beyond the permitted region.

Question 22Cloud Email Architecture and Deployment Models

During a hybrid deployment, a cloud mailbox sends to an on-premises distribution group that expands to members in both environments. What must be true for delivery to succeed for all members?

  1. The distribution group must be cloud-only and expanded before reaching on-premises transport.
  2. Expansion must occur in an environment that can route to both cloud and on-premises recipients, with connectors in both directions. Correct answer.
  3. The on-premises transport must reject messages addressed to cloud members.
  4. The cloud tenant must have no accepted domains for the on-premises namespace.

Explanation

When a group spans both environments, expansion must happen where routing can reach every member, and bidirectional connectors must exist so each side can deliver its portion. Forcing cloud-only expansion or rejecting cloud members breaks delivery, and the on-premises namespace must be an accepted domain in the cloud tenant.

Question 23Cloud Email Architecture and Deployment Models

An organization publishes a DMARC record with p=quarantine and pct=25. What is the practical effect on unauthenticated mail claiming to be from the domain?

  1. Roughly a quarter of such mail is subject to quarantine treatment while the rest is delivered normally. Correct answer.
  2. All such mail is delivered but reported to the domain owner.
  3. All such mail is rejected outright.
  4. Only mail that passes DKIM is quarantined.

Explanation

The pct tag applies the requested policy to a percentage of failing messages, so pct=25 means about a quarter are quarantined while the remainder are handled per the lesser policy. Rejection requires p=reject, and reporting-only behavior corresponds to p=none.

Question 24Cloud Email Architecture and Deployment Models

A company uses a third-party filtering service in front of its cloud email tenant. Inbound mail flows to the filter first, then to the tenant. Which configuration set is required so that the tenant accepts filtered mail and outbound mail bypasses the filter appropriately?

  1. MX records pointing to the tenant, with the filter configured as a smart host for outbound only
  2. MX records pointing to the filter, a connector trusting the filter's IPs for inbound, and an outbound path that does not loop through the filter Correct answer.
  3. No MX changes, with SPF records removed to allow the filter
  4. A DKIM key published at the filter with no connector configuration

Explanation

When a filter sits in front, MX records must direct inbound mail to the filter, and the tenant needs a connector that trusts the filter's source IPs so filtered mail is accepted without additional challenges. Outbound routing must avoid looping back through the filter unless intentionally designed to do so.

Question 25Cloud Email Architecture and Deployment Models

An organization wants to decommission its on-premises email servers after a hybrid period but must retain the ability to manage certain recipient attributes in the cloud. Which sequence best supports a clean decommissioning?

  1. Keep on-premises servers indefinitely to preserve attribute management.
  2. Remove directory synchronization first, then move remaining mailboxes, then delete connectors.
  3. Delete the on-premises servers immediately and rely on cached credentials for administration.
  4. Move all mailboxes to the cloud, redirect on-premises routing, verify mail flow, then decommission synchronization and servers in a controlled order. Correct answer.

Explanation

A safe decommissioning moves all mailboxes, ensures routing no longer depends on the on-premises environment, validates mail flow end to end, and then removes synchronization and servers in a planned order. Removing synchronization first or deleting servers early can strand mailboxes and break routing.

Question 26Cloud Email Architecture and Deployment Models

Which cloud email deployment model gives an organization the highest degree of control over the physical location of mailbox data and the underlying server infrastructure?

  1. A public multi-tenant cloud email service with mailboxes distributed across the provider's global regions
  2. A hybrid deployment where mailboxes remain on-premises but routing uses a cloud service
  3. A private cloud email deployment hosted in the organization's own data center Correct answer.
  4. A community cloud shared by several organizations in the same industry

Explanation

A private cloud deployment places the email infrastructure and data under the organization's direct administrative and physical control, so it can dictate data location and server configuration. Public multi-tenant and community clouds shift infrastructure control to the provider, while a hybrid model still depends on provider regions for any cloud-hosted mailboxes.

Question 27Cloud Email Architecture and Deployment Models

In a cloud email architecture, which component is responsible for enforcing message hygiene policies such as malware scanning and content filtering before messages reach user mailboxes?

  1. The mailbox database layer that stores messages on disk
  2. The client access layer that handles MAPI, IMAP, and ActiveSync connections
  3. The transport or mail flow layer that processes messages in transit Correct answer.
  4. The directory synchronization service that replicates user objects

Explanation

Message hygiene controls are applied by the transport pipeline as messages travel between the internet, the organization, and mailbox stores. The client access layer only handles client protocol connections, directory synchronization replicates identity data, and the mailbox database layer provides storage rather than inspection.

Question 28Cloud Email Architecture and Deployment Models

An organization wants to route all outbound mail from its cloud mailboxes through an on-premises email appliance for encryption before delivery to the internet. Which configuration is required in the cloud tenant to support this architecture?

  1. A Send connector scoped to the appliance's address space with a smart host set to the appliance Correct answer.
  2. A receive connector that allows anonymous relay from the appliance's IP address
  3. An accepted domain configured as an authoritative domain for the appliance's namespace
  4. A mailbox transport rule that redirects messages to the appliance's journaling mailbox

Explanation

Outbound routing through an on-premises appliance is achieved with a Send connector whose address space covers the external recipients and whose smart host points to the appliance. Accepted domains define namespaces the tenant accepts, receive connectors control inbound connections to the tenant, and transport rules redirect or copy messages rather than change the delivery path.

Question 29Cloud Email Architecture and Deployment Models

A company is designing a cloud email deployment that must remain available if an entire provider region fails. Which design element most directly provides that resilience?

  1. Increasing the number of mailbox servers within the primary region to add redundancy
  2. Deploying mailboxes across two or more provider regions with automated failover for client access Correct answer.
  3. Configuring a single region with multiple availability zones for the mailbox databases
  4. Adding a second internet connection at the corporate office for client access

Explanation

Regional failure resilience requires that mailbox data and client access endpoints exist in more than one provider region, with failover mechanisms to redirect clients when a region becomes unavailable. Multiple availability zones or additional servers within one region protect against local failures but not the loss of the whole region, and a second office internet link does not affect provider-side availability.

Question 30Cloud Email Architecture and Deployment Models

An administrator is planning a cloud email deployment for a regulated customer and must determine whether the provider supports customer-managed encryption keys for mailbox data at rest. Which architectural consideration is most relevant to that requirement?

  1. Whether the provider offers a bring-your-own-key or customer key model integrated with the tenant's key management service Correct answer.
  2. Whether the provider publishes a DMARC policy for its own service domains
  3. Whether the provider allows IMAP access from third-party email clients
  4. Whether the provider supports TLS 1.2 for SMTP transport between tenants

Explanation

Customer-managed encryption keys for data at rest depend on the provider offering a bring-your-own-key or customer key capability tied to the customer's key management service. Transport encryption, DMARC policies, and client protocol support address different concerns and do not give the customer control over mailbox data encryption keys.

Question 31Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Which DNS record type is used to publish an SPF policy for a domain?

  1. SRV
  2. MX
  3. CNAME
  4. TXT Correct answer.

Explanation

An SPF policy is published as a TXT record at the domain (or subdomain) being authorized, beginning with the version tag v=spf1. MX and other record types serve unrelated routing purposes and are not read by SPF evaluators.

Question 32Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

What does the SPF mechanism '-all' instruct a receiving system to do with mail that fails all preceding mechanisms?

  1. Defer the decision to DKIM
  2. Quarantine it as a soft fail
  3. Accept it with a neutral result
  4. Mark it as a hard fail Correct answer.

Explanation

In SPF syntax a hyphen prefix means Fail, so '-all' declares that any sender not matching earlier mechanisms is unauthorized and should be treated as a hard failure. The softfail qualifier is '~all', and neutral is '?all'.

Question 33Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Which key is used by a receiver to validate a DKIM signature?

  1. The public key published in the selector's DNS record Correct answer.
  2. The private key published in the selector's DNS record
  3. The TLS session key negotiated with the sending MTA
  4. The domain's DMARC aggregate report key

Explanation

DKIM uses asymmetric cryptography: the signer holds the private key and the receiver fetches the matching public key from a TXT record at selector._domainkey.domain. The private key must never be published, and neither DMARC reports nor TLS keys participate in signature validation.

Question 34Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Which header field carries the policy that a DMARC record publishes for handling failing mail?

  1. The adkim= tag inside the MX record
  2. The p= tag inside the DMARC TXT record Correct answer.
  3. The v= tag inside the DKIM key record
  4. The rua= tag inside the SPF record

Explanation

DMARC policy is expressed in the p= tag of the _dmarc TXT record, with values none, quarantine, or reject. SPF and DKIM records do not carry a disposition policy, and MX records have no tag syntax at all.

Question 35Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

What is the primary purpose of the ARC set of headers?

  1. To replace DMARC authentication with a reputation score
  2. To preserve authentication results across intermediaries that may break SPF or DKIM Correct answer.
  3. To encrypt the message body between MTAs
  4. To publish a domain's sending policy in DNS

Explanation

ARC records the authentication assessment of the earliest hop and seals it so that later hops can trust results even when forwarding modifies the message or changes the envelope sender. It supplements, rather than replaces, SPF, DKIM, and DMARC.

Question 36Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

A domain publishes 'v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all'. What is the effect of the include mechanism here?

  1. It authorizes every host listed in the included domain's SPF policy Correct answer.
  2. It copies the included domain's DNS records into the local zone
  3. It ignores the included policy when the local policy ends in -all
  4. It requires the included domain to pass DKIM

Explanation

The include mechanism causes the receiver to evaluate the referenced domain's SPF record and treat a pass there as a match for the including domain. It performs a live DNS lookup rather than copying records, and it has no relationship to DKIM.

Question 37Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

In a DKIM-Signature header, what does the 'h=' tag list?

  1. The canonicalization applied to the body
  2. The header fields that were hashed into the signature Correct answer.
  3. The key selector and domain
  4. The hash algorithm used for the body

Explanation

The h= tag enumerates the signed header field names in the order they were hashed, which is why adding or altering a listed header invalidates the signature. Algorithm, selector, and canonicalization are carried by other tags.

Question 38Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Which DMARC tag tells receivers where to send aggregate XML reports?

  1. ruf
  2. pct
  3. fo
  4. rua Correct answer.

Explanation

The rua tag specifies URIs for aggregate reports, which summarize many messages in XML. The ruf tag is for forensic failure reports, pct sets the sampling percentage, and fo controls which failure conditions trigger reporting.

Question 39Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

A message arrives with an envelope sender of [email protected] and a visible From domain of bank.example. Which identity does DMARC use to look up policy?

  1. The domain in the topmost Received header
  2. The HELO name of the sending MTA
  3. The envelope sender domain, mailer.example
  4. The visible From domain, bank.example Correct answer.

Explanation

DMARC aligns against the RFC5322.From domain that the recipient sees, because that is the identity users and mail clients trust. SPF is checked against the envelope domain, but DMARC policy lookup keys off the visible From domain.

Question 40Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

A domain sets adkim=r in its DMARC record. How is DKIM alignment then judged?

  1. Alignment is skipped and only SPF is evaluated
  2. The organizational domain of d= must match the organizational domain of From Correct answer.
  3. Any valid DKIM signature satisfies alignment regardless of domain
  4. The d= domain must exactly equal the From domain

Explanation

Relaxed alignment (adkim=r) permits a match at the organizational-domain level, so a signature from a subdomain of the same registrable domain can align. Strict alignment (adkim=s) would require an exact domain match.

Question 41Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

A receiver finds a valid SPF pass for the envelope domain but no DKIM signature and no From-domain alignment. Under a DMARC policy of p=reject, what is the correct disposition?

  1. Quarantine, because SPF passed but DKIM was absent
  2. Reject, because neither SPF nor DKIM aligned with the From domain Correct answer.
  3. Defer to the next hop for a final decision
  4. Accept, because SPF passed

Explanation

DMARC requires at least one aligned authentication result, meaning a pass whose domain matches the From domain. An SPF pass on an unrelated envelope domain does not align, so with no DKIM the message fails DMARC and the reject policy applies.

Question 42Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Which SPF result is produced when evaluation requires more DNS lookups than the permitted limit?

  1. permerror Correct answer.
  2. none
  3. temperror
  4. neutral

Explanation

Exceeding the lookup limit is a permanent configuration error, returned as permerror, because the record itself is defective and retrying will not help. Temperror is reserved for transient DNS failures, and none means no SPF record exists.

Question 43Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

What does the DKIM body hash (bh=) tag protect against?

  1. Forgery of the selector name in DNS
  2. Replay of the signature to a different recipient
  3. Tampering with the SMTP envelope
  4. Alteration of the message body after signing Correct answer.

Explanation

The bh= value is a hash of the canonicalized body, so any change to the body after signing causes the body hash check to fail. Envelope data and selector DNS records lie outside what the body hash covers.

Question 44Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

An organization forwards mail and wants to preserve the original authentication assessment for the final destination. Which ARC header carries the cryptographic seal over the chain?

  1. ARC-Seal Correct answer.
  2. Received-SPF
  3. ARC-Message-Signature
  4. ARC-Authentication-Results

Explanation

The ARC-Seal signs the complete ARC set, including prior seals, so a verifier can confirm the chain was not altered in transit. ARC-Message-Signature covers the message itself, and ARC-Authentication-Results records the assessment as text.

Question 45Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Why does a mailing list commonly cause DMARC failures for the original author's domain?

  1. The list may modify the body or subject, breaking DKIM, and uses its own envelope sender, breaking SPF alignment Correct answer.
  2. The list rewrites the From domain to its own domain
  3. The list removes all Received headers
  4. The list disables TLS between hops

Explanation

List processing often adds subject tags or footers that invalidate the author's DKIM signature, while the envelope sender becomes the list's bounce address, which does not align with the author's From domain. Either change alone can cause a DMARC failure at the final receiver.

Question 46Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

A domain owner wants DMARC reports but is not ready to enforce policy. Which record best fits?

  1. v=DMARC1; p=reject; rua=mailto:[email protected]
  2. v=DMARC1; p=none; rua=mailto:[email protected] Correct answer.
  3. v=DKIM1; k=rsa; p=MIIB...
  4. v=spf1 -all

Explanation

Setting p=none requests monitoring only while rua collects aggregate data, which is the standard first phase of DMARC rollout. The other records either enforce immediately or belong to entirely different protocols.

Question 47Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

What is the effect of publishing 'v=spf1 -all' for a domain that sends no mail?

  1. It asserts that no host is authorized to send as the domain Correct answer.
  2. It authorizes all senders
  3. It disables DMARC evaluation
  4. It redirects SPF checks to another domain

Explanation

With no permitting mechanisms and a hard fail qualifier, every sending host fails SPF, which is the recommended posture for non-sending domains. It does not disable DMARC and performs no redirection.

Question 48Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

A DKIM verification fails with 'signature did not verify' while the DNS key is present and the body is unchanged. Which cause is most plausible?

  1. The message was delivered over an unencrypted SMTP hop
  2. The From domain lacks an SPF record
  3. The receiving MTA has no DMARC record
  4. The signer used a selector whose key was rotated after signing Correct answer.

Explanation

If the published key no longer matches the private key used at signing time, for example after a key rotation that replaced the DNS record, the signature cannot verify even though the body is intact. Transport encryption, SPF, and DMARC publication are unrelated to cryptographic verification of the signature.

Question 49Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

Which statement best describes the relationship between organizational domain and DMARC alignment?

  1. The organizational domain is the exact hostname in the From header
  2. The organizational domain is always the top-level label of the envelope sender
  3. The organizational domain is the registrable domain derived from the From domain, used in relaxed alignment Correct answer.
  4. The organizational domain is defined by the MX record of the sending host

Explanation

The organizational domain is the registrable domain, such as example.com, obtained from the From domain using public suffix rules. Relaxed alignment compares organizational domains, so mail.example.com can align with example.com.

Question 50Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

What does the DMARC pct tag control?

  1. The percentage of aggregate reports sent per day
  2. The percentage of DKIM keys that must be rotated annually
  3. The percentage of messages to which the published policy is applied Correct answer.
  4. The percentage of SPF lookups allowed per message

Explanation

The pct tag tells receivers to apply the requested disposition to only that share of failing messages, letting a domain ramp up enforcement gradually. It does not govern key rotation, SPF lookup counts, or report frequency.