After LDAP accept is enabled, what is the best solution to prevent directory harvest attacks?

Question

Options

• ASpecify all of the legitimate mailbox addresses in the RAT.
• BModify the default mail flow policy.
• CCreate an access list as a content dictionary and match this resource, with a content filter, against
• DCreate an access list as a content dictionary and match this resource, with a message filter, against

• A
  13% (6)
• B
  77% (37)
• C
  6% (3)
• D
  4% (2)

Explanation

Modifying the default mail flow policy is correct because Cisco ESA's mail flow policies contain the Directory Harvest Attack Prevention (DHAP) settings, which let you define how many invalid recipients are allowed per SMTP connection before the appliance drops it - directly countering automated address probing at the connection layer, where harvesting actually occurs.

Option A is wrong because the RAT (Recipient Access Table) defines which domains the appliance accepts mail for, not how many invalid recipient attempts to tolerate per connection; it offers no rate-limiting or drop behavior against harvesters. Options C and D are wrong because content dictionaries and message/content filters operate on message content after the SMTP session, whereas directory harvesting exploits the SMTP handshake itself - filtering at the content layer is too late and irrelevant to the attack vector.

Memory tip: Think "flow = connection behavior." DHAP is a connection-level defense, so it lives in the mail flow policy, not in content filters or the RAT. If the attack happens during the SMTP conversation, the fix lives in the policy that governs that conversation.

No community discussion yet for this question.