nerdexam
CompTIA

SY0-501 · Question #292

Many employees are receiving email messages similar to the one shown below: From IT department To employee Subject email quota exceeded username and password to increase your email quota. Upon…

The correct answer is D. DENY http://*.info/email.php?quota=1Gb. Option D is correct because it precisely targets all three identified common elements of the phishing URLs: the HTTP protocol, the .info TLD (using a wildcard * to catch any subdomain), and the specific URI '/email.php?quota=1Gb'. This specificity ensures the rule blocks the…

Submitted by fatema_kw· Mar 4, 2026CompTIA Security+ - Threats, Attacks and Vulnerabilities / Implement cybersecurity controls to mitigate phishing attacks using content filtering rules

Question

Many employees are receiving email messages similar to the one shown below:

From IT department To employee Subject email quota exceeded username and password to increase your email quota. Upon reviewing other similar emails, the security administrator realized that all the phishing URLs have the following common elements; they all use HTTP, they all come from .info domains, and they all contain the same URI. Which of the following should the security administrator configure on the corporate content filter to prevent users from accessing the phishing URL, while at the same time minimizing false positives?

Options

How the community answered

(62 responses)
  • A
    2% (1)
  • B
    5% (3)
  • C
    11% (7)
  • D
    82% (51)

Explanation

Option D is correct because it precisely targets all three identified common elements of the phishing URLs: the HTTP protocol, the .info TLD (using a wildcard * to catch any subdomain), and the specific URI '/email.php?quota=1Gb'. This specificity ensures the rule blocks the known malicious pattern without broadly blocking legitimate .info domain traffic, thereby minimizing false positives while maximizing protection.

Topics

#Content Filtering#Phishing Prevention#URL Filtering#Threat Mitigation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice