CompTIA CySA+ (CS0-002) — Question 321

An analyst is reviewing email headers to determine if an email has been sent from a legitimate sender. The organization uses SPF to validate email origination. Which of the following most likely indicates an invalid originator?

Answer options

Correct answer: C

Explanation

A 'Received-SPF: softfail' indicates that the email was likely sent from a host not authorized by the SPF record, suggesting that the originator is not legitimate. In contrast, 'neutral', 'none', and 'error' statuses do not definitively indicate an invalid sender; 'neutral' means the server cannot determine legitimacy, 'none' means no SPF record was found, and 'error' indicates an issue with the SPF check itself.