nerdexam
CompTIA

CAS-003 · Question #576

A company's user community is being adversely affected by various types of emails whose authenticity cannot be trusted. The Chief Information Security Officer (CISO) must address the problem. Which…

The correct answer is A. Enabling spam filtering and DMARC. DMARC combined with spam filtering provides the most comprehensive solution for email authenticity by enforcing policy on SPF and DKIM alignment while also filtering unsolicited and malicious messages.

Technical Integration of Enterprise Security

Question

A company's user community is being adversely affected by various types of emails whose authenticity cannot be trusted. The Chief Information Security Officer (CISO) must address the problem. Which of the following solutions would BEST support trustworthy communication solutions?

Options

  • AEnabling spam filtering and DMARC.
  • BUsing MFA when logging into email clients and the domain.
  • CEnforcing HTTPS everywhere so web traffic, including email, is secure.
  • DEnabling SPF and DKIM on company servers.
  • EEnforcing data classification labels before an email is sent to an outside party.

How the community answered

(39 responses)
  • A
    82% (32)
  • B
    3% (1)
  • C
    5% (2)
  • D
    3% (1)
  • E
    8% (3)

Why each option

DMARC combined with spam filtering provides the most comprehensive solution for email authenticity by enforcing policy on SPF and DKIM alignment while also filtering unsolicited and malicious messages.

AEnabling spam filtering and DMARC.Correct

DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM to define an organizational policy - reject, quarantine, or none - for emails that fail authentication checks, providing active enforcement against spoofed and impersonated messages. Pairing DMARC with spam filtering addresses both inauthentic emails and unsolicited bulk messages comprehensively. DMARC also generates aggregate and forensic reports, giving administrators visibility into domain abuse.

BUsing MFA when logging into email clients and the domain.

MFA protects the login process for email accounts but does not authenticate the origin or integrity of email messages in transit, leaving domain spoofing and phishing unaddressed.

CEnforcing HTTPS everywhere so web traffic, including email, is secure.

HTTPS secures web traffic in transit using TLS but is not an email authentication mechanism and does not verify the identity or legitimacy of email senders.

DEnabling SPF and DKIM on company servers.

SPF and DKIM provide the underlying authentication signals but without DMARC there is no enforcement policy that instructs receiving mail servers how to act on authentication failures - DMARC is required to operationalize SPF and DKIM protections.

EEnforcing data classification labels before an email is sent to an outside party.

Data classification labels govern outbound sensitive data handling but do not verify the authenticity of email senders or protect against incoming spoofed or fraudulent messages.

Concept tested: Email anti-spoofing and authentication using DMARC policy

Source: https://datatracker.ietf.org/doc/html/rfc7489

Topics

#DMARC#spam filtering#email authentication#phishing defense

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice