CAS-003 · Question #709
The email administrator must reduce the number of phishing emails by utilizing more appropriate security controls. The following configurations already are in place - Keyword Mocking based on word…
The correct answer is B. Configure appropriate regular expression rules per suspicious email received. Given that keyword word-list matching is already in place, configuring regular expression (regex) rules provides more precise and flexible pattern matching tailored to the specific characteristics of suspicious emails as they are received. Regex allows administrators to craft…
Question
The email administrator must reduce the number of phishing emails by utilizing more appropriate security controls. The following configurations already are in place
- Keyword Mocking based on word lists
- URL rewriting and protection
- Stopping executable files from messages
Which of the following is the BEST configuration change for the administrator to make?
Options
- AConfigure more robust word lists for blocking suspicious emails
- BConfigure appropriate regular expression rules per suspicious email received
- CConfigure Bayesian filtering to block suspicious inbound email
- DConfigure the mail gateway to strip any attachments
How the community answered
(26 responses)- A4% (1)
- B77% (20)
- C12% (3)
- D8% (2)
Explanation
Given that keyword word-list matching is already in place, configuring regular expression (regex) rules provides more precise and flexible pattern matching tailored to the specific characteristics of suspicious emails as they are received. Regex allows administrators to craft granular patterns that go beyond static word lists, targeting structural patterns in phishing emails (e.g., spoofed sender formats, obfuscated URLs). Option C (Bayesian filtering) is a valid and often more effective long-term approach as it learns statistically from spam patterns; however, the question implies a targeted, reactive improvement to existing controls, which regex best provides. Option D (stripping attachments) is too broad and would disrupt legitimate business email.
Topics
Community Discussion
No community discussion yet for this question.