A network administrator notices that there are a high number of queries to the LDAP server. The mail logs show an entry "550 Too many invalid recipients | Connection closed by foreign host." Which…

The correct answer is A. DHAP. DHAP stands for Directory Harvest Attack Prevention. A directory harvest attack (DHA) occurs when spammers or attackers send email to large numbers of randomly generated or guessed addresses at a domain, using the '550 User Unknown' bounce responses to identify valid addresses…

Cisco ESA LDAP, Mail Policies, and Authentication

Question

A network administrator notices that there are a high number of queries to the LDAP server. The mail logs show an entry "550 Too many invalid recipients | Connection closed by foreign host." Which feature must be used to address this?

Options

ADHAP
BSBRS
CLDAP
DSMTP

How the community answered

(30 responses)

A
73% (22)
B
7% (2)
C
17% (5)
D
3% (1)

Explanation

DHAP stands for Directory Harvest Attack Prevention. A directory harvest attack (DHA) occurs when spammers or attackers send email to large numbers of randomly generated or guessed addresses at a domain, using the '550 User Unknown' bounce responses to identify valid addresses. Each invalid recipient attempt causes the ESA to query the LDAP directory, generating excessive load on the LDAP server. DHAP detects this pattern and drops the connection after a configurable number of invalid recipient errors per session, protecting both the LDAP server and the directory from enumeration. SBRS (B) is the SenderBase Reputation Score used to evaluate sender IP reputation. LDAP (C) is the directory protocol itself, not a protective feature. SMTP (D) is the mail transfer protocol, not a countermeasure.

Topics

#Directory Harvest Attack Prevention#DHAP#Email Security#Recipient Validation

Community Discussion

No community discussion yet for this question.

Full 300-720 Practice