5.7 Email Security Features CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company wants to block emails that spoof their own domain to prevent phishing attacks against their employees. They have already implemented SPF and DKIM. What should you configure to ensure that emails failing authentication are not delivered to inboxes?

   • AConfigure a content filter to block messages containing the company domain in the From header.
   • BEnable TLS encryption for all inbound email to prevent spoofing.
   • CCreate a mail policy that quarantines messages with a DMARC fail result.
   • DSet up a recipient filter to reject messages from external senders that match the company domain.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A law firm must ensure that emails containing confidential client information are encrypted when sent to external parties. They also want to avoid encrypting routine emails. What is the best approach?

   • AUse DLP to block all emails with the word 'confidential'.
   • BEncrypt all emails by default.
   • CCreate a mail policy that triggers encryption based on content filters for keywords like 'confidential'.
   • DEnable TLS for all outbound email.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational company has a mail gateway that processes email for multiple domains. They need to enforce different policies for different departments: HR emails must be encrypted, finance emails must be scanned for DLP, and all suspicious emails must be quarantined. They also want to minimize administrative overhead. What is the most efficient way to implement this?

   • AConfigure DLP policies for all departments and use encryption for all outbound email.
   • BUse a single global mail policy that applies encryption and DLP to all emails.
   • CImplement a quarantine for all emails and manually release them.
   • DCreate separate mail policies for each department, each with the appropriate actions (encrypt, DLP, quarantine).
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization is required to prevent the leakage of personally identifiable information (PII) via email. They have a DLP solution that can detect PII patterns, but they are concerned about false positives that could quarantine legitimate emails. They also need to ensure that any emails containing PII are encrypted if they are sent externally. What approach balances security and usability?

   • ADisable DLP and rely on user training to prevent PII leakage.
   • BConfigure DLP to quarantine emails with PII and allow end-users to release them after review.
   • CBlock all emails containing PII and require manual approval from IT.
   • DSet DLP to automatically encrypt all emails with PII without quarantine.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is managing a quarantine for a large enterprise. They notice that many legitimate emails are being quarantined due to strict DMARC policies. They want to reduce false positives while maintaining security. What should they do?

   • AChange the DMARC policy from reject to none to stop quarantining.
   • BReview DMARC reports and adjust SPF/DKIM alignment to ensure legitimate senders pass authentication.
   • CDisable DMARC entirely and rely on SPF only.
   • DIncrease the quarantine retention period to allow more time for review.
   Reveal Solution Discussion Select an answer first