A security analyst finds that 12 out of 80 emails in a batch were spoofed. What is the spoofing rate (in percentage)?

An attacker sends 300 phishing emails, 45 of which are clicked by users. What is the click-through rate of this phishing campaign?

An organization uses 2048-bit RSA keys for email encryption. If the same organization decides to use a symmetric key equivalent, what should be the key length (in bits) approximately?

A secure email protocol encrypts both header and body, which results in a 25% increase in message size. What is the final size of a 4 KB email after encryption?

An organization uses an email filter that successfully blocks 920 out of 1000 spam messages. What is its spam blocking accuracy (in percentage)?

If an encrypted email system introduces a 60 ms delay per email due to cryptographic processing, how long will it take (in seconds) to process 1000 emails?

A company processes 10,000 emails per hour. If 5% of them are infected with malware, how many emails per hour must be quarantined?

An attacker forges an email identity using a compromised SMTP server. If it takes 7 seconds per message and they send 360 messages, how long (in minutes) does the whole operation take?

If an email encryption system uses a 256-bit key and a message digest of 512 bits, what is the combined bit-length of both operations?

During a penetration test, 120 spoofed emails were sent, and only 18 were marked as “suspicious” by the email client. What is the detection rate in percentage?

An email security gateway reports 99.8% accuracy. Out of 5000 messages, how many were misclassified?

An email system employs SSL/TLS to protect communication. However, an attacker manages to intercept and replay previously sent encrypted messages to a recipient. Which security property is primarily compromised here?

A company uses SPF and DKIM to verify incoming emails. An email passes SPF but fails DKIM validation. What is the most likely implication?

Why is the Simple Mail Transfer Protocol (SMTP) vulnerable to spoofing attacks?

In email security, which of the following techniques primarily prevents unauthorized modification of an email’s content during transit?

A user receives an email claiming to be from their bank, asking for password reset via a link. Which security attack is this an example of?

Which layer of the Internet protocol stack is primarily responsible for email delivery?

An email system employs both encryption and hashing. Which combination of security goals do these techniques achieve?

Why is end-to-end encryption critical in secure email systems?

Which type of email attack exploits software vulnerabilities to automatically forward emails without user consent?

A company notices a surge in emails claiming to be from their domain but sent by unauthorized users. What technique can they implement to reduce this spoofing?

A digital signature is verified using the sender’s public key. Which property does this guarantee?

Why might relying solely on encryption fail to protect against replay attacks in email?

Which email security feature helps ensure the sender cannot deny sending an email?

An email is sent with an encrypted body but an unencrypted subject line. What potential risk remains?

Which protocol extends SMTP to allow message submission and authentication for outgoing email?

You receive an email with a suspicious “Received” header showing multiple unknown relay servers from foreign IP addresses. What does this most likely indicate?

The “From” field in an email header shows a trusted domain, but the “Reply-To” field contains a different, unknown domain. What security risk does this pose?

In an email header, the “Message-ID” field is identical for two distinct emails received several days apart. What can this duplication imply?

An email header includes the following line: DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1;. What does the s=selector1 indicate?

How does the “Received” header help in forensic email analysis?

If an email header shows “X-Originating-IP” as a private IP (e.g., 192.168.x.x), what can be inferred?

Why is the “Return-Path” header important in email delivery?

Assertion (A): The “Subject” header can be used to filter spam effectively. Reason (R): The “Subject” is always encrypted and verified in email headers.

An email header shows multiple “Received” fields. Which “Received” header is closest to the original sender?

An email’s “Content-Type” header is set to “text/html” instead of “text/plain.” What security risk might this pose?

You notice an email header with “Authentication-Results: fail (spf)”. What does this mean?

Which header can reveal the mail client software used to send the email?

An attacker modifies an email header to hide the original sender IP address. Which header field is most likely targeted?

An email claims to come from your CEO but the “Reply-To” header directs replies to an unknown external email address. What kind of attack is this?

The “X-Spam-Status” header in an email show “No, score=4.0 required=5.0”. What does this indicate about the email?

PGP encrypts a message by first compressing it, then encrypting the compressed data with a session key, which is itself encrypted with the recipient’s public key. Why is compression done before encryption?

In PGP, the digital signature is created by:

Which of the following is NOT a feature provided by PGP?

When Bob receives a PGP message from Alice, what keys does he use to decrypt the message?

Assertion (A): PGP uses both symmetric and asymmetric encryption to balance security and performance. Reason (R): Symmetric encryption is faster but key distribution is challenging, asymmetric encryption is slower but simplifies key distribution.

In PGP, what is the purpose of the “Web of Trust”?

Which hash algorithm is commonly used by PGP for message digest?

What does PGP do if the recipient’s public key is not found during encryption?

If a PGP message contains a 2 KB compressed message encrypted by a 128-bit symmetric session key, how many bits is the key?

What is the significance of "Key ID" in PGP key management?

Why is PGP considered vulnerable if the private key is compromised?

How does PGP ensure message integrity?

Alice sends a signed and encrypted message to Bob using PGP. Bob finds the signature invalid. What could be the reason?

Which of the following is TRUE about PGP key revocation?

In PGP, what is the role of a session key?

S/MIME provides email security by combining encryption and digital signatures. Which standard is primarily used for the digital signature in S/MIME?

In S/MIME, what format is used to bundle the signed and encrypted message along with certificates?

Assertion (A): S/MIME encrypts the entire email content including attachments. Reason (R): S/MIME uses symmetric encryption for the message and asymmetric encryption for the session key.

How does S/MIME handle certificate validation to establish trust?

Which of the following is NOT supported by S/MIME?

What does S/MIME use to generate the symmetric session key used to encrypt the message body?

An email message encrypted using S/MIME is 10 MB. If the symmetric encryption algorithm used has a block size of 128 bits and the padding adds 8 bytes, what is the approximate size of the encrypted message in MB?

Which certificate format does S/MIME typically use for certificates?

If an S/MIME-encrypted email is sent to a recipient whose public key certificate is expired, what happens?

Which of the following best describes S/MIME’s method to prevent email spoofing?

68. Assertion (A): S/MIME allows multiple recipients to be encrypted with the same message content. Reason (R): S/MIME encrypts the session key separately for each recipient’s public key.

A limitation of S/MIME compared to PGP is:

When an S/MIME email is digitally signed, what does the recipient use to verify the signature?

What encryption algorithms are commonly used in S/MIME for symmetric encryption?

An organization uses S/MIME to secure emails. A recipient receives a message but cannot open it because the client says the certificate is not trusted. What is a probable cause?

An email filtering system uses Bayesian spam filtering, which calculates the probability that an email is spam based on the presence of certain words. If the word "free" appears in 80% of spam emails and 10% of legitimate emails, how does the presence of "free" affect the spam probability?

In a machine learning-based spam detection system, which of the following features is least likely to improve classification accuracy?

75. Assertion (A): Email spam detection systems often use blacklists to block known spam IP addresses. Reason (R): Blacklists are dynamic and updated frequently to include new spammers.

Why is it difficult for spam filters to detect phishing emails that mimic legitimate business communications?

Which of the following is an example of a false positive in spam detection?

A spam filter classifies 1200 emails. 100 are spam, and it correctly identifies 90 spam emails. What is the real rate of the spam filter?

What is the primary purpose of the SPF (Sender Policy Framework) record in combating spam?

Assertion (A): Content-based spam filters analyze email headers and body text to detect spam. Reason (R): Content-based filters rely solely on sender IP reputation.

An email filter uses a Support Vector Machine (SVM) trained on features extracted from email text. What is the role of the kernel function in SVM?

Which of the following is a disadvantage of rule-based spam filtering systems?

A company notices many phishing emails bypassing their spam filter. Analysis shows most phishing emails spoof the sender address of trusted contacts. What technical control can help mitigate this?

In a spam classification task, if the precision is 0.95 and the number of true positives is 190, how many false positives did the system classify?

WPA2 is a security protocol used to provide users and firms with strong data security and protection for their networks to give them confidence that only authorized users can access their network.

Extensible authentication protocol is authentication framework frequently used in ______

PGP is an encryption method used _____ to encrypt and decrypt the content of an e-mail transmitted over the internet. It makes sure that the message cannot be stolen by other unauthorized users.

In a ____, the attacker won’t let the victims access the network by using a certain method that ensures that an essential network resource is unavailable to the victim. The methods that the attacker can use are vulnerability attack, bandwidth flooding and connection flooding.

IPSec is a set of protocols used to provide authentication, data integrity and confidentiality between two machines in an IP network. In the TCP/IP model, it provides security at the ______

When a DNS server accepts and uses incorrect information from a host that has no authority giving that information, then it is called

Which authentication protocol is commonly used for securing internet communication, providing secure and encrypted connections?

X.509 Digital Certificates are used for ____, ensuring that the communication parties are who they claim to be.

Which access control mechanism grants or denies access based on the user’s identity and their permissions?

An ip address which is 32 bits long, that means it is of 4 bytes and is composed of a network and host portion and it depends on address class. The size of the ____ depends upon the class of the address in classful IP addressing.

A ____ also called as VCID (virtual circuit identifier) is a type of identifier which is used to distinguish between several virtual circuits in a connection oriented circuit switched network. Each virtual circuit is used to transfer data over a larger packet switched network.

Spanning tree protocol (STP) is a network protocol that creates a loop free logical topology for ethernet networks. It is a layer 2 protocol that runs on bridges and switches. The main purpose of STP is to ensure that you do not create loops when you have redundant paths in your network.

Internet Control Message Protocol is used by networking devices to send ____ and operational information indicating a host or router cannot be reached. ICMP operates over the IP packet to provide error reporting functionality as IP by itself cannot report errors.

For each ______ the Kerberos Key Distribution Center (KDC) maintains a database of the realm’s principal and the principal’s associated “secret keys”.

KDC uses the client’s secret and the server’s secret to construct _____ which allows the client and server to mutually authenticate each other, while keeping the secrets hidden.

Linux systems can store Kerberos authentication keys for a service principal in ______ files.