nerdexam
EC-Council

312-50V10 · Question #82

While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong…

The correct answer is E. None of the above. None of the listed options correctly addresses blocking unauthorized telnet access to port 25 without disrupting legitimate SMTP email functionality.

Information Security and Ethical Hacking Fundamentals

Question

While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong doing. However, you are concerned about affecting the normal functionality of the email server. From the following options choose how best you can achieve this objective?

Options

  • ABlock port 25 at the firewall.
  • BShut off the SMTP service on the server.
  • CForce all connections to use a username and password.
  • DSwitch from Windows Exchange to UNIX Sendmail.
  • ENone of the above.

How the community answered

(48 responses)
  • A
    6% (3)
  • B
    2% (1)
  • C
    2% (1)
  • D
    10% (5)
  • E
    79% (38)

Why each option

None of the listed options correctly addresses blocking unauthorized telnet access to port 25 without disrupting legitimate SMTP email functionality.

ABlock port 25 at the firewall.

Blocking port 25 at the firewall would prevent all inbound SMTP connections from other mail servers, completely breaking email reception for the organization.

BShut off the SMTP service on the server.

Shutting off the SMTP service eliminates email functionality entirely, which directly contradicts the requirement to preserve normal email server operation.

CForce all connections to use a username and password.

Requiring a username and password via SMTP AUTH does not prevent TCP connections to port 25 - it only adds a login step after the connection is already established, which does not block telnet sessions.

DSwitch from Windows Exchange to UNIX Sendmail.

Switching from Windows Exchange to UNIX Sendmail is irrelevant to the access control problem; the same port 25 exposure exists regardless of the mail server software used.

ENone of the above.Correct

SMTP itself is a plaintext, command-driven protocol that behaves identically to a telnet session on port 25 - legitimate mail servers connect the same way. Blocking port 25 at the firewall or shutting off the SMTP service would break inbound email delivery. The correct mitigation would be to restrict which source IPs can reach port 25 using firewall ACLs, or to require STARTTLS, neither of which is offered as a choice here.

Concept tested: SMTP port 25 access control limitations

Source: https://datatracker.ietf.org/doc/html/rfc5321

Topics

#SMTP#port 25#firewall rules#email security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice