CompTIA CySA+ Practice Test

What initial information is needed to investigate the source of spam emails that have led to a company's email servers being blacklisted?

1. Firewall logs showing the SMTP connections

2. The SMTP audit log from the company's email server

3. The full email header from one of the spam messages

4. Network flows for the DMZ containing the email servers

The correct answer is: The full email header from one of the spam messages

The full email header from one of the spam messages contains critical information that helps in investigating the source of spam emails. Email headers provide a detailed trail of the email's journey, including the originating IP address, the mail servers it passed through, timestamps, and potential discrepancies that can indicate spoofing or phishing attempts. Analyzing the header allows security analysts to trace back to the source of the spam, identify the mail servers involved, and understand if the emails were sent using a compromised account or if they originated from a malicious actor. This information is essential for determining not only the source but also the nature of the spam attacks, which is key for taking appropriate remedial actions to clear the email server's reputation and prevent future occurrences. While firewall logs, SMTP audit logs, and network flows provide valuable supplementary data, they do not contain the direct provenance and detailed tracking that the email header offers.