CAS-005 · Question #408
A company that operates in different countries has local email infrastructure for each of its business units. A breach occurred in which email communications were intercepted between the…
The correct answer is C. Change the TLS configuration from opportunistic to enforced. The log shows a STARTTLS negotiation failure followed by email transmission without encryption. This indicates the mail server is using opportunistic TLS, which falls back to plaintext if encryption fails - leaving email vulnerable to interception. Enforcing TLS ensures…
Question
A company that operates in different countries has local email infrastructure for each of its business units. A breach occurred in which email communications were intercepted between the headquarters and one of the overseas business units. During an investigation, the security analyst finds the following email log:
Which of the following actions should the security analyst take to best address the issue?
Exhibits
Options
- ARevoke the expired TLS certificate and replace it with a valid one
- BDisable the NTLM authentication and replace it with TLS 1.2
- CChange the TLS configuration from opportunistic to enforced
- DCreate a new TLS certificate using a stronger algorithm and larger key
How the community answered
(27 responses)- A15% (4)
- B7% (2)
- C56% (15)
- D22% (6)
Explanation
The log shows a STARTTLS negotiation failure followed by email transmission without encryption. This indicates the mail server is using opportunistic TLS, which falls back to plaintext if encryption fails - leaving email vulnerable to interception. Enforcing TLS ensures communication only proceeds if encryption is successful, effectively mitigating this risk.
Community Discussion
No community discussion yet for this question.