NSE7 Advanced Threat Protection Practice Question
A security analyst is investigating a phishing email that bypassed email security. The email's headers show SPF=pass, DKIM=pass, but DMARC=quarantine. The email was delivered to the inbox. What is the most likely reason DMARC did not block or quarantine the email?
⚠ Common exam trap
Fortinet often tests the misconception that a DMARC policy of 'quarantine' or 'reject' will always block or quarantine emails that fail SPF or DKIM, but the trap here is that DMARC only applies its policy when both SPF and DKIM fail alignment; if either passes alignment, DMARC considers the email authentic and does not enforce the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic
DMARC uses SPF and DKIM alignment to determine authenticity. When both SPF and DKIM pass and are aligned (i.e., the domain in the From header matches the domain used in SPF/DKIM), DMARC considers the email authentic and applies the policy accordingly. In this case, the DMARC policy was set to 'quarantine', but because alignment checks passed, DMARC treated the email as legitimate and allowed delivery to the inbox, rather than quarantining it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The email was sent from a subdomain not covered by DMARC
Why it's wrong here
DMARC can cover subdomains if configured. The header shows DMARC=quarantine, indicating it was processed.
- ✓
The SPF and DKIM alignment checks passed, so DMARC treated the email as authentic
Why this is correct
DMARC uses alignment of SPF and DKIM. If both pass, DMARC passes, and the policy (quarantine) is not triggered.
- ✗
The DMARC record had a pct (percentage) of less than 100
Why it's wrong here
While possible, the most common reason is that DMARC passed, so the policy was not enforced.
- ✗
The DMARC policy was set to 'none'
Why it's wrong here
The header shows DMARC=quarantine, not none.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.