Spammers routinely try to send emails with the recipient field filled with a list of all possible combinations of letters and numbers. These combinations, appended with a company's domain name are…

Question

Options

• AQuarantine external authentication queries.
• BEnable end user safelist features.
• CPerform LDAP acceptance validation.
• DSelect the SMTP Authentication Query checkbox.

• A
  11% (3)
• B
  4% (1)
• C
  79% (22)
• D
  7% (2)

Explanation

This attack is called a Directory Harvest Attack (DHA). Attackers send emails to every possible address combination at a domain to discover which ones are valid based on bounce vs. acceptance responses. LDAP Acceptance Validation on the Cisco ESA solves this by querying the organization's LDAP directory (e.g., Active Directory) to verify that a recipient address actually exists before the ESA accepts the message. If the address is not found in the LDAP directory, the ESA rejects it during the SMTP conversation with a 5xx error, preventing the attacker from learning which addresses are valid. Option A (quarantine external auth queries) does not address recipient validation. Option B (end user safelist) manages trusted senders, not recipient validity. Option D (SMTP Authentication Query) authenticates senders, not validates recipients.

No community discussion yet for this question.