nerdexam
CompTIA

CAS-003 · Question #418

The Chief Executive Officers (CEOs) from two different companies are discussing the highly sensitive prospect of merging their respective companies together. Both have invited their Chief…

The correct answer is D. Switch both domains to utilize DNSSEC. DNSSEC provides cryptographic integrity for DNS records and, when paired with DANE, enforces encrypted mail transport - securing email routing and transmission between domains.

Technical Integration of Enterprise Security

Question

The Chief Executive Officers (CEOs) from two different companies are discussing the highly sensitive prospect of merging their respective companies together. Both have invited their Chief Information Officers (CIOs) to discern how they can securely and digitaly communicate, and the following criteria are collectively determined:

  • Must be encrypted on the email servers and clients
  • Must be OK to transmit over unsecure Internet connections

Which of the following communication methods would be BEST to recommend?

Options

  • AForce TLS between domains.
  • BEnable STARTTLS on both domains.
  • CUse PGP-encrypted emails.
  • DSwitch both domains to utilize DNSSEC.

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    8% (2)
  • D
    83% (20)

Why each option

DNSSEC provides cryptographic integrity for DNS records and, when paired with DANE, enforces encrypted mail transport - securing email routing and transmission between domains.

AForce TLS between domains.

Force TLS encrypts email only in transit between mail servers but provides no protection against DNS-based routing attacks that could redirect messages before TLS is negotiated.

BEnable STARTTLS on both domains.

STARTTLS is opportunistic and susceptible to downgrade attacks where a man-in-the-middle strips the STARTTLS offer, resulting in plaintext transmission over an unsecure connection.

CUse PGP-encrypted emails.

PGP encrypts message content end-to-end but does not secure DNS routing, does not enforce server-level TLS, and requires both parties to exchange and manage public keys out-of-band.

DSwitch both domains to utilize DNSSEC.Correct

DNSSEC cryptographically signs DNS records, preventing DNS spoofing that could redirect email to rogue servers. Combined with DANE (DNS-Based Authentication of Named Entities via TLSA records), DNSSEC enforces authenticated TLS on mail servers, ensuring email is encrypted at the server level and cannot be intercepted or downgraded over unsecured internet connections. This satisfies both the server-level encryption and safe internet-transmission criteria.

Concept tested: DNSSEC and DANE for authenticated encrypted email transport

Source: https://www.rfc-editor.org/rfc/rfc7671

Topics

#email security#end-to-end encryption#PGP#secure communications

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice