Courseiva
Advanced Threat ProtectionmediumMultiple SelectObjective-mapped

NSE7 Advanced Threat Protection Practice Question

An organization wants to implement email authentication to prevent spoofing. Which TWO standards should they configure? (Choose two.)

⚠ Common exam trap

Fortinet often tests the distinction between authentication standards (SPF, DKIM) and transport security protocols (TLS, STARTTLS), leading candidates to mistakenly select TLS or STARTTLS as anti-spoofing measures when they only provide encryption, not sender verification.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

SPF

SPF (Sender Policy Framework) is correct because it allows the domain owner to publish a list of authorized sending IP addresses in a DNS TXT record, enabling receiving mail servers to verify that the email originated from an approved source. DKIM (DomainKeys Identified Mail) is correct because it adds a digital signature to email headers, which the receiving server validates against a public key published in DNS, ensuring the message was not tampered with and truly came from the claimed domain. Together, SPF and DKIM form the foundational layers of email authentication that DMARC builds upon.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • SPF

    Why this is correct

    SPF specifies which servers are authorized to send email.

  • DMARC

    Why it's wrong here

    DMARC uses SPF and DKIM; it is not a standalone authentication.

  • TLS

    Why it's wrong here

    TLS encrypts email in transit, not authentication.

  • STARTTLS

    Why it's wrong here

    Also encryption, not authentication.

  • DKIM

    Why this is correct

    DKIM adds a digital signature to verify email integrity.

Visual reference

Client Recursive Resolver Root DNS (13 root servers) TLD DNS (.com, .org, …) Authoritative example.com query IP addr answer

About these practice questions

One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.