A computer on a company network was infected with a zero-day exploit after an employee accidently opened an email that contained malicious content. The employee recognized the email as malicious and…

Host-based firewalls control network traffic in and out of a system but do not inspect or sanitize email content, so they would not prevent a malicious email from executing its payload when opened.

Setting the email client to render messages in plain text by default prevents the execution of embedded HTML, scripts, and active content that zero-day exploits commonly use as delivery mechanisms. Since plain text strips out HTML rendering and active elements, malicious payloads embedded in rich content cannot execute even if the email is opened. This is a proactive configuration control that mitigates the risk of accidental opening of malicious emails.

Endpoint protection (antivirus/anti-malware) may not detect zero-day exploits by definition, as these are unknown threats without existing signatures, making this an insufficient standalone preventive control for this specific scenario.

Blocking a single sender address only prevents future emails from that specific address and does not address the broader threat of zero-day exploits delivered via email, as attackers can easily use different or spoofed sender addresses.