CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Man-in-the-middle

  Why it's wrong here

  Man-in-the-middle (MITM) attacks rely on intercepting and relaying traffic between two legitimate endpoints, allowing the attacker to read or alter messages in transit. In email, that could involve hijacking SMTP sessions or exploiting STARTTLS, but the observed mismatch between the From domain and the originating server is a static artifact in the message headers, not evidence of a live interception. The header can be forged at creation time without any on-path attacker, so the available data points to spoofed identities, not a compromised communication channel.

• ✓

  Email spoofing

  Why this is correct

  Email spoofing is the forgery of email header fields, typically the From/Reply-To address, to make a message appear to originate from a trusted source while it actually came from an unrelated or attacker-controlled server. Here, the originating Received server and HELO/EHLO identity do not align with the claimed From domain, which is exactly the signature of a spoofed message. SMTP lacks built-in sender authentication, so unlike a MITM that alters traffic in transit, this anomaly is the result of direct manipulation of the message headers during composition.

• ✗

  Malware attachment

  Why it's wrong here

  Choosing malware attachment would require evidence of a payload, such as a suspicious file name, executable MIME type, or an embedded URL referenced in the headers—none of which is present in this observation. A From domain and originating server mismatch reveals identity fraud, not the presence of a malicious payload; malware can just as easily be delivered from an authentic domain. The header anomaly alone cannot support a malware verdict because it explains only the message's claimed provenance, not its content.

• ✗

  Phishing

  Why it's wrong here

  Phishing describes a malicious campaign that uses deception to persuade a victim into taking a harmful action, such as revealing credentials or downloading malware, and it often includes psychological lures. Whereas email spoofing is the precise header-forgery technique seen here, phishing is a broader goal-oriented attack that may or may not use forged headers. Without evidence of the intended lure, landing page, or call-to-action, the observed mismatch explains the impersonation mechanism but does not prove the full phishing objective.

Go deeper

Related to this question