Skip to content

Home
Catalog
Custom Training
About
Contact

Email Authentication & DNS Security

Email Authentication & DNS Security for IT Staff
Email Authentication & DNS Security

This exam covers all six modules of the course. Passing requires 80% or higher; passing earns the Isidore Training certificate of completion.

Time limit: 0

Quiz Summary

0 of 25 Questions completed

Questions:

Information

You have already completed the quiz before. Hence you can not start it again.

Quiz is loading…

You must sign in or sign up to start the quiz.

You must first complete the following:

Results

Quiz complete. Results are being recorded.

Results

0 of 25 Questions answered correctly

Your time:

Time has elapsed

You have reached 0 of 0 point(s), (0)

Earned Point(s): 0 of 0, (0)
0 Essay(s) Pending (Possible Point(s): 0)

Categories

Not categorized 0%

Review
Answered
Correct
Incorrect

Question 1 of 25

1. Question
1 point(s)

You run dig acme.com and the header reads status: SERVFAIL. A coworker says, “the domain is broken — it doesn’t exist.” What is the most accurate read of that status code?

The domain has been deleted at the registry, so all queries will fail until it is re-registered.
Correct Incorrect Correct answer

The recursive resolver tried to answer but could not get an authoritative response — the authoritative nameservers are unreachable or misbehaving.
Correct Incorrect Correct answer

The record type you queried does not exist for that name; query a different record type to confirm.
Correct Incorrect Correct answer

Your local DNS cache is stale; flush it and retry against 1.1.1.1.
Correct Incorrect Correct answer

Correct

Incorrect
Question 2 of 25

2. Question
1 point(s)

Cathedra reports the MX TTL Sanity check as warning / low: “MX record TTL is 60s, which is very low. This causes excessive DNS lookups.” The client, morrison-legal.com, is migrating from on-prem Exchange to M365 next Wednesday. Is the warning relevant, and what should you do?

Raise the TTL to 3600s today to clear the warning before the cutover; revert it after the migration if needed.
Correct Incorrect Correct answer

The warning is correct in isolation but irrelevant during a planned cutover — the low TTL is what you want before a migration. Note the warning, leave it, and raise the TTL to 3600s once the cutover is verified stable.
Correct Incorrect Correct answer

Ignore the warning; Cathedra misclassifies any TTL below 300s and the check should be suppressed.
Correct Incorrect Correct answer

Raise the TTL to 86,400s to maximize cache hits during the migration window.
Correct Incorrect Correct answer

Correct

Incorrect
Question 3 of 25

3. Question
1 point(s)

Cathedra’s DnsHygieneCheck reports the following on bluepeak.io: NS Records pass (4 records), NS Provider Consistency warning / low (“NS records point to multiple providers (godaddy.com, cloudflare.com)”), CAA Records info (“No CAA records found”), DNSSEC info (“No DNSKEY record detected”). Which finding requires same-day remediation?

NS Provider Consistency — multiple NS providers is always a misconfiguration and must be reduced to one provider.
Correct Incorrect Correct answer

CAA Records — every domain must have CAA records or certificate issuance is blocked.
Correct Incorrect Correct answer

DNSSEC — without DNSKEY, the domain is open to DNS spoofing and must be remediated immediately.
Correct Incorrect Correct answer

None of them. The NS warning may reflect an intentional secondary DNS service (confirm with the client). CAA and DNSSEC are info-level by design in Cathedra — missing them is a hardening opportunity, not a failure.
Correct Incorrect Correct answer

Correct

Incorrect
Question 4 of 25

4. Question
1 point(s)

northforge.partners has a single MX record: 0 northforge-partners-com.mail.protection.outlook.com. A junior tech argues this is a single point of failure and recommends adding a secondary MX. What is the correct response?

Agree — a second MX is required for redundancy. Add a backup MX with priority 10 pointing to a secondary provider.
Correct Incorrect Correct answer

Disagree — Microsoft 365 (and Google Workspace) handle inbound redundancy server-side behind one published MX hostname. A second MX is unnecessary and can introduce unintended routing through a backup that does not enforce the same security controls.
Correct Incorrect Correct answer

Agree — but the secondary MX should point back to the primary at a higher priority number to act as a failover.
Correct Incorrect Correct answer

Disagree — but only because the priority should be 10, not 0; the single-MX shape is fine.
Correct Incorrect Correct answer

Correct

Incorrect
Question 5 of 25

5. Question
1 point(s)

You audit a new client and find their MX record points to acme-com.mail.protection.outlook.com, but the SPF record contains include:spf.protection.outlook.com include:_spf.google.com. What is the most likely explanation, and what should you do first?

The client uses Google Workspace as the primary mail platform and M365 as a backup; leave the SPF as-is.
Correct Incorrect Correct answer

The client probably migrated from Google Workspace to M365 and the old Google include was never removed. Confirm with the client, then remove the unused include to reduce the lookup count and the spoofable attack surface.
Correct Incorrect Correct answer

Cathedra’s provider detection is wrong; manually override the provider field to Google Workspace.
Correct Incorrect Correct answer

Both providers are sending mail concurrently in a split-domain configuration; document it and move on.
Correct Incorrect Correct answer

The Google include is required by M365 to relay calendar invites; leave it in place.
Correct Incorrect Correct answer

Correct

Incorrect
Question 6 of 25

6. Question
1 point(s)

Cathedra’s Autodiscover check reports that autodiscover.acme.com does not exist. The client uses M365 and reports no end-user complaints. How do you classify and prioritize this finding?

Critical — Outlook will not connect to mailboxes without an Autodiscover CNAME; users will be locked out within hours.
Correct Incorrect Correct answer

Low — Outlook can fall back to M365’s Autodiscover redirect, but adding the CNAME at autodiscover.{domain} pointing to autodiscover.outlook.com reduces setup friction for new users and devices. Schedule it as a hygiene fix, not an emergency.
Correct Incorrect Correct answer

Ignore — modern Outlook no longer uses Autodiscover and the check is obsolete.
Correct Incorrect Correct answer

Critical — the absence of the record indicates a hijacked DNS zone and the registrar must be contacted immediately.
Correct Incorrect Correct answer

Correct

Incorrect
Question 7 of 25

7. Question
1 point(s)

Cathedra reports the SPF check as warning / medium: “SPF ends with ~all (soft fail). Unauthorized senders may still be delivered.” The client is mid-engagement on email modernization; three legitimate senders were added to SPF in the last month and DMARC is at p=none with rua= configured. What is the right next step?

Change ~all to -all immediately; the record was approved when the senders were added, so it is safe.
Correct Incorrect Correct answer

Leave ~all in place and document the warning in the client report — moving to -all is unnecessary if DMARC will eventually reject anyway.
Correct Incorrect Correct answer

Pull the most recent two to four weeks of DMARC aggregate reports, confirm every legitimate sender is appearing with SPF pass and alignment, then change to -all and re-run Cathedra.
Correct Incorrect Correct answer

Move DMARC to p=reject first; once that is in place the SPF qualifier no longer matters.
Correct Incorrect Correct answer

Correct

Incorrect
Question 8 of 25

8. Question
1 point(s)

A client’s SPF record reads: v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:servers.mcsv.net include:mailgun.org include:spf.mandrillapp.com include:spf-vrf.0001.outboundmail.sendgrid.net include:_spf.intuit.com include:netfilter.zoom.us include:_spf.atlassian.net include:_spf.constantcontact.com include:_spf-bd5h.constantcontact.com -all. What does Cathedra report?

Pass — the record ends with -all and contains valid includes.
Correct Incorrect Correct answer

Pass on enforcement (-all), plus a separate warning / medium on SPF Lookup Limit because the record contains 11 include mechanisms, exceeding RFC 7208’s cap of 10 DNS lookups.
Correct Incorrect Correct answer

Error — RFC 7208 forbids more than five include mechanisms in a single record.
Correct Incorrect Correct answer

Pass — the lookup limit only counts a and mx mechanisms, not include.
Correct Incorrect Correct answer

Correct

Incorrect
Question 9 of 25

9. Question
1 point(s)

On a single audit, Cathedra returns error / high: “2 SPF records found. RFC 7208 requires exactly one. This causes unpredictable evaluation.” Both records are: v=spf1 include:spf.protection.outlook.com -all and v=spf1 include:sendgrid.net -all. What is the correct remediation?

Delete the SendGrid record; M365 outranks transactional senders.
Correct Incorrect Correct answer

Delete the M365 record; SendGrid is the more recent addition.
Correct Incorrect Correct answer

Merge both into one TXT record: v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all. Delete the originals.
Correct Incorrect Correct answer

Leave both in place but add a third record with v=spf2.0 declaring an order of precedence.
Correct Incorrect Correct answer

Correct

Incorrect
Question 10 of 25

10. Question
1 point(s)

Cathedra returns error / critical: “SPF ends with +all or ?all, which allows any server to send as this domain.” The raw record is v=spf1 include:spf.protection.outlook.com ?all. The client says, “the previous MSP set ?all intentionally to avoid breaking mail; we should leave it.” How do you respond?

Agree — ?all is the safe neutral posture and should remain in place until DMARC is at p=reject.
Correct Incorrect Correct answer

Disagree — ?all tells receivers to make no SPF judgment, which is functionally worse than having no SPF at all because the record signals an intended (but ineffective) policy. Replace with -all the same day, or move to ~all if a confirmation cadence is required.
Correct Incorrect Correct answer

Agree — keep ?all and add DMARC at p=reject; DMARC overrides SPF.
Correct Incorrect Correct answer

Disagree — change to +all so the record is at least explicit about its intent.
Correct Incorrect Correct answer

Correct

Incorrect
Question 11 of 25

11. Question
1 point(s)

Which of the following SPF records would Cathedra grade as warning rather than pass or error? Select all that apply.

v=spf1 include:spf.protection.outlook.com -all
Correct Incorrect Correct answer

v=spf1 include:spf.protection.outlook.com ~all
Correct Incorrect Correct answer

v=spf1 include:spf.protection.outlook.com
Correct Incorrect Correct answer

v=spf1 include:spf.protection.outlook.com +all
Correct Incorrect Correct answer

v=spf1 a mx include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:_spf.salesforce.com include:mailgun.org include:servers.mcsv.net include:_spf.constantcontact.com -all
Correct Incorrect Correct answer

Correct

Incorrect
Question 12 of 25

12. Question
1 point(s)

Cathedra returns warning on the DKIM check for a Mimecast-fronted domain: “No DKIM records found for common selectors. This may not be an error if a non-standard selector is in use.” What is the right next step?

Mark DKIM as broken in the report and recommend the client enable DKIM signing immediately.
Correct Incorrect Correct answer

Pull a recent inbound message’s DKIM-Signature header from the client, read the s= tag for the selector, then query that selector at {selector}._domainkey.{domain} to confirm the key is published. Document the custom selector in the client record before reporting DKIM as missing.
Correct Incorrect Correct answer

Re-run Cathedra three times to confirm; if the warning persists, DKIM is definitively absent.
Correct Incorrect Correct answer

Add CNAMEs for selector1._domainkey and selector2._domainkey pointing to the M365 tenant, since those are the standard selectors.
Correct Incorrect Correct answer

Correct

Incorrect
Question 13 of 25

13. Question
1 point(s)

You are enabling DKIM for a new M365 tenant on bluepeak.io. The Defender admin page shows you must publish two CNAMEs. The client uses GoDaddy DNS, delegated access. What records do you publish, and what does the right side of each CNAME look like?

Two TXT records at selector1._domainkey and selector2._domainkey containing the public keys directly.
Correct Incorrect Correct answer

One CNAME at _dkim pointing to dkim.outlook.com.
Correct Incorrect Correct answer

Two CNAMEs at selector1._domainkey and selector2._domainkey pointing to selector1-bluepeak-io._domainkey.{tenant}.onmicrosoft.com and selector2-bluepeak-io._domainkey.{tenant}.onmicrosoft.com respectively, using the exact targets M365 generated.
Correct Incorrect Correct answer

Two A records at selector1 and selector2 pointing to Microsoft’s published DKIM IPs.
Correct Incorrect Correct answer

Correct

Incorrect
Question 14 of 25

14. Question
1 point(s)

M365 publishes two DKIM selectors (selector1 and selector2). Why two?

Microsoft requires two for redundancy in case one CNAME is deleted by accident.
Correct Incorrect Correct answer

One signs outbound mail; the other signs internal mail. The split is required for compliance with EU regulations.
Correct Incorrect Correct answer

Two selectors allow Microsoft to rotate signing keys without downtime — the new key is published under the inactive selector first, signing flips to the new selector, then the old one is updated. At any moment, one selector is active and the other is staged.
Correct Incorrect Correct answer

Two selectors let M365 sign with two different cryptographic algorithms (RSA and Ed25519) simultaneously.
Correct Incorrect Correct answer

Correct

Incorrect
Question 15 of 25

15. Question
1 point(s)

A vendor sends you a DKIM-Signature header for review:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=morrison-legal.com; s=mailjet; h=from:to:subject:date; bh=...; b=...
What domain and selector should you query to retrieve the public key?

morrison-legal.com with selector default
Correct Incorrect Correct answer

mailjet._domainkey.morrison-legal.com
Correct Incorrect Correct answer

morrison-legal.mailjet._domainkey.com
Correct Incorrect Correct answer

morrison-legal.com at the apex with the public key in a TXT record beginning v=DKIM1
Correct Incorrect Correct answer

Correct

Incorrect
Question 16 of 25

16. Question
1 point(s)

_dmarc.acme.com reads: v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@acme.com. The client’s marketing director reports that her external scheduling tool stopped sending confirmation emails this week. Which three signals in the aggregate report most directly help confirm or refute that DMARC is the cause?

The p= value, the sp= value, and the rua= address.
Correct Incorrect Correct answer

The sending IP listed for the scheduling tool, the SPF and DKIM authentication results for that IP/domain pair, and the disposition (none / quarantine / reject) the receiver applied.
Correct Incorrect Correct answer

The DNS TTL on the DMARC record, the receiver’s MX record, and the timestamp of the report.
Correct Incorrect Correct answer

The recipient’s email client, the recipient’s spam folder size, and the bounce code returned to the sender.
Correct Incorrect Correct answer

Correct

Incorrect
Question 17 of 25

17. Question
1 point(s)

A domain publishes v=DMARC1; policy=reject; rua=mailto:dmarc@northforge.partners. What does Cathedra report, and why?

pass — the policy is set to reject.
Correct Incorrect Correct answer

warning / high — the parser does not find a p tag (the tag is named policy, not p), so the value defaults to none and the finding is “DMARC policy is p=none. Unauthenticated mail is not blocked or quarantined.”
Correct Incorrect Correct answer

error / high — the record is malformed and Cathedra returns “No DMARC record found.”
Correct Incorrect Correct answer

pass — Cathedra is case-insensitive and accepts policy as a synonym for p.
Correct Incorrect Correct answer

Correct

Incorrect
Question 18 of 25

18. Question
1 point(s)

A client wants to deploy DMARC quickly. Their domain has SPF at ~all, DKIM signed by M365 (selector1 and selector2 detected), and no existing DMARC record. They ask you to publish p=reject directly to skip the staged ramp. What do you do?

Publish v=DMARC1; p=reject; rua=mailto:dmarc@{domain} immediately — strong DKIM coverage means alignment will pass for legitimate mail.
Correct Incorrect Correct answer

Decline the shortcut. Publish v=DMARC1; p=none; rua=mailto:dmarc@{domain} first and run it for four to six weeks. Read the aggregate reports, identify every legitimate sender (especially marketing platforms and CRMs that may not be aligned), fix alignment, then ramp through p=quarantine; pct=10 upward to p=reject.
Correct Incorrect Correct answer

Publish v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@{domain} as a middle-ground compromise.
Correct Incorrect Correct answer

Publish v=DMARC1; p=reject; sp=none; rua=mailto:dmarc@{domain} so that subdomains are not affected by the strict policy.
Correct Incorrect Correct answer

Correct

Incorrect
Question 19 of 25

19. Question
1 point(s)

A domain publishes v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@bluepeak.io. Which Cathedra findings will appear?

DMARC Policy: pass only.
Correct Incorrect Correct answer

DMARC Policy: pass, plus DMARC Coverage: warning / low with “DMARC pct=25%. Policy only applies to 25% of failing messages.”
Correct Incorrect Correct answer

DMARC Policy: warning / medium because pct < 100 downgrades the effective policy to quarantine.
Correct Incorrect Correct answer

DMARC Policy: error / high because pct=25 is invalid with p=reject.
Correct Incorrect Correct answer

Correct

Incorrect
Question 20 of 25

20. Question
1 point(s)

Which of the following are accurate statements about DMARC alignment? Select all that apply.

Strict alignment (aspf=s, adkim=s) requires the SPF or DKIM domain to match the From header domain exactly.
Correct Incorrect Correct answer

Relaxed alignment (the default) allows the authenticated domain to be an organizational match — for example, mail.acme.com aligns with From: user@acme.com.
Correct Incorrect Correct answer

DMARC requires both SPF and DKIM to pass and align; if either fails, DMARC fails.
Correct Incorrect Correct answer

DMARC alignment is checked against the visible From: header, not the SMTP MAIL FROM envelope.
Correct Incorrect Correct answer

DMARC alignment is checked against the SMTP MAIL FROM envelope; the visible From: header is irrelevant.
Correct Incorrect Correct answer

If both SPF and DKIM fail authentication outright, DMARC can still pass when the From header matches the receiver’s allowlist.
Correct Incorrect Correct answer

Correct

Incorrect
Question 21 of 25

21. Question
1 point(s)

Cathedra reports MTA-STS DNS Record as pass (TXT exists) but MTA-STS Policy File as error / medium: “MTA-STS DNS record exists but policy file at https://mta-sts.acme.com/.well-known/mta-sts.txt returned HTTP 404.” What is the operational implication, and what do you fix first?

Receivers will reject all inbound mail because MTA-STS is in a broken state.
Correct Incorrect Correct answer

Receivers that consult MTA-STS will treat the policy as undefined and fall back to opportunistic TLS, but the misconfiguration signals abandoned hardening. Fix the policy file (host mta-sts.{domain} with /.well-known/mta-sts.txt served over a valid HTTPS cert) before any other MTA-STS work.
Correct Incorrect Correct answer

Delete the MTA-STS DNS TXT record to stop receivers from looking for the policy file.
Correct Incorrect Correct answer

Set the policy mode to none in DNS to disable enforcement until the file is back.
Correct Incorrect Correct answer

Correct

Incorrect
Question 22 of 25

22. Question
1 point(s)

Cathedra reports MTA-STS Policy File as warning / low: “MTA-STS policy file fetched. Mode: testing.” What does testing mode do, and when do you graduate to enforce?

testing means receivers reject mail when TLS fails, and the recommendation is to graduate to enforce within 24 hours.
Correct Incorrect Correct answer

testing means receivers will report TLS failures (via TLS-RPT if configured) but will not block mail when TLS validation fails. Graduate to enforce once TLS-RPT reports show every legitimate inbound source is presenting a valid cert that matches an MX in the policy.
Correct Incorrect Correct answer

testing disables MTA-STS entirely until the timestamp ID is incremented.
Correct Incorrect Correct answer

testing is the default and identical to enforce; the warning is cosmetic.
Correct Incorrect Correct answer

Correct

Incorrect
Question 23 of 25

23. Question
1 point(s)

You run Cathedra Mail Diagnostics on morrison-legal.com and see four findings. Which do you prioritize FIRST in your remediation list to the client?
A) MTA-STS DNS Record: info — “No MTA-STS TXT record found.”
B) DMARC Record: error / high — “No DMARC record found at _dmarc.morrison-legal.com.”
C) SPF Enforcement: warning / medium — “SPF ends with ~all (soft fail).”
D) CAA Records: info — “No CAA records found.”

A — MTA-STS is the modern transport security control and should be deployed first.
Correct Incorrect Correct answer

B — DMARC missing is an error / high finding and is the only one that leaves the domain entirely undefended against spoofing at the policy layer. Phase 1 (publish p=none; rua=) is non-disruptive and unlocks visibility for everything else.
Correct Incorrect Correct answer

C — SPF soft-fail is the most visible finding to receivers and should be hardened first.
Correct Incorrect Correct answer

D — CAA prevents unauthorized cert issuance and is a same-day fix.
Correct Incorrect Correct answer

Correct

Incorrect
Question 24 of 25

24. Question
1 point(s)

A client emails: “Cathedra is showing an SMTP Connectivity error — port 25 STARTTLS failed. Are we under attack?” You check from the client site and STARTTLS works fine. What is the most likely explanation?

An attacker has stripped STARTTLS in transit; escalate to the security team.
Correct Incorrect Correct answer

Cathedra runs from a fixed network egress; outbound port 25 may be firewalled at the host or upstream from where Cathedra runs. Not every “error” on this check is a real issue — verify with an independent test from a different vantage point and a check of the receiving server’s logs before reporting it as a transport issue.
Correct Incorrect Correct answer

The MX record points to a server that does not exist; reissue the MX record.
Correct Incorrect Correct answer

The mail provider rotated certificates; wait 24 hours and re-run.
Correct Incorrect Correct answer

Correct

Incorrect
Question 25 of 25

25. Question
1 point(s)

Capstone scenario. A new client onboarding audit on northforge.partners returns: SPF error / high (“No SPF record found”); DMARC error / high (“No DMARC record found”); DKIM warning (“No DKIM records found for common selectors”); MX points to northforge-partners.mail.protection.outlook.com; MTA-STS info (not deployed); NS Records pass; CAA info (none). What is the correct sequence for Phase 1 of remediation, before any DMARC ramping?

Deploy MTA-STS first, then DKIM, then SPF, then DMARC p=reject.
Correct Incorrect Correct answer

1) Confirm in IT Glue whether the client is Isidore-managed or delegated GoDaddy. 2) Enable DKIM in M365 Defender and publish both selector CNAMEs. 3) Publish SPF: v=spf1 include:spf.protection.outlook.com -all (only safe because no third-party senders are documented yet — re-verify with the client). 4) Publish DMARC at p=none with rua= to begin collecting reports. Then ramp DMARC over the following weeks.
Correct Incorrect Correct answer

Publish DMARC p=reject first to immediately block spoofing, then add SPF and DKIM in parallel.
Correct Incorrect Correct answer

Publish SPF with ~all to be safe, leave DKIM disabled until DMARC reports come in, and skip DMARC entirely until Phase 2.
Correct Incorrect Correct answer

Correct

Incorrect

About Isidore Training

Isidore Training is operated by The Isidore Group — a managed service and security operator serving healthcare, financial services, accounting, legal, construction, and manufacturing.

Start a conversation ›

Website

Home
Catalog
Custom Training
About

Resources

Contact
Privacy Policy
Terms

Support

Start a Conversation

© 2026 Isidore Training - WordPress Theme by Kadence WP

Home
Catalog
Custom Training
About
Contact