CAS-002 · Question #787
Customers are receiving emails containing a link to malicious software. These emails are subverting spam filters. The email reads as follows: Delivered-To: [email protected] Received: by…
The correct answer is B. Block port 25 on the firewall for all unauthorized mail servers. D. Shut down the SMTP service on the unauthorized mail server. Email headers reveal the malicious messages originate from an unauthorized internal mail server; blocking its SMTP port at the firewall and disabling its SMTP service together eliminate the threat at both the network and host levels.
Question
Customers are receiving emails containing a link to malicious software. These emails are subverting spam filters. The email reads as follows:
Delivered-To: [email protected] Received: by 10.14.120.205 Mon, 1 Nov 2010 11:15:24 -0700 (PDT) Received: by 10.231.31.193 Mon, 01 Nov 2010 11:15:23 -0700 (PDT) Return-Path: [email protected] Received: from 127.0.0.1 for [email protected]; Mon, 1 Nov 2010 13:15:14 -0500 (envelope-from [email protected]) Received: by smtpex.example.com (SMTP READY) with ESMTP (AIO); Mon, 01 Nov 2010 13:15:14 -0500 Received: from 172.18.45.122 by 192.168.2.55; Mon, 1 Nov 2010 13:15:14 -0500 From: Company [email protected] To: "[email protected]" [email protected] Date: Mon, 1 Nov 2010 13:15:11 -0500 Subject: New Insurance Application Thread-Topic: New Insurance Application Please download and install software from the site below to maintain full access to your account. ________________________________ Additional information: The authorized mail servers IPs are 192.168.2.10 and 192.168.2.11. The network's subnet is 192.168.2.0/25. Which of the following are the MOST appropriate courses of action a security administrator could take to eliminate this risk? (Select TWO).
Options
- AIdentify the origination point for malicious activity on the unauthorized mail server.
- BBlock port 25 on the firewall for all unauthorized mail servers.
- CDisable open relay functionality.
- DShut down the SMTP service on the unauthorized mail server.
- EEnable STARTTLS on the spam filter.
How the community answered
(54 responses)- A20% (11)
- B67% (36)
- C4% (2)
- E9% (5)
Why each option
Email headers reveal the malicious messages originate from an unauthorized internal mail server; blocking its SMTP port at the firewall and disabling its SMTP service together eliminate the threat at both the network and host levels.
Identifying the origination point is a forensic step that documents the attack source but does not actively stop the unauthorized server from continuing to send malicious emails to customers.
Blocking port 25 on the firewall for all unauthorized mail servers prevents them from establishing outbound SMTP sessions to deliver malicious emails, cutting off the delivery path at the network perimeter before messages reach recipients.
Disabling open relay prevents third parties from anonymously forwarding email through a server, but the attack here involves a server that is directly sending spoofed emails rather than relaying traffic from an external party.
Shutting down the SMTP service on the unauthorized mail server at 172.18.45.122 directly eliminates the source of the attack, preventing it from generating or queuing any further outbound malicious email traffic.
STARTTLS encrypts SMTP sessions in transit to protect confidentiality but provides no content filtering, sender authentication, or blocking capability against malicious emails from unauthorized servers.
Concept tested: Unauthorized SMTP server blocking and email threat mitigation
Source: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/mail-flow-best-practices
Topics
Community Discussion
No community discussion yet for this question.