5.7 Email Security Features CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard · select all that apply

   A company is implementing email authentication. They want to ensure that: (1) all outgoing emails are signed with DKIM, (2) receiving servers can verify the signature, and (3) emails that fail authentication are rejected. Which of the following should be configured? (Select all that apply.)

   • AEnable TLS for all outbound email.
   • BConfigure the mail server to sign all outgoing emails with the DKIM private key.
   • CPublish a DMARC policy with p=reject.
   • DGenerate a DKIM key pair and publish the public key in DNS.
   • ECreate a mail policy that adds a disclaimer to all outgoing emails.
   Check answers Discussion Select an answer first
2. 22application · medium

   An organization must prevent credit card numbers from being sent via email. They have a mix of Outlook clients and webmail users. What is the most effective approach?

   • AUse a mail policy that restricts email sending to internal recipients only.
   • BDeploy a DLP policy that scans email content and attachments for credit card patterns and blocks/quarantines matches.
   • CConfigure quarantine for all messages with attachments.
   • DEnable encryption for all outbound email to protect the data in transit.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard · select all that apply

   A healthcare organization must ensure that emails containing patient health information (PHI) are encrypted. They also want to prevent PHI from being sent to unauthorized external recipients. Which of the following should be configured? (Select all that apply.)

   • AUse S/MIME certificates for all external recipients.
   • BDLP policy that detects PHI and applies encryption.
   • CMail policy that restricts PHI emails to approved external domains.
   • DEnable TLS for all outbound email.
   • EQuarantine all emails containing PHI for manual review.
   Check answers Discussion Select an answer first
5. 24application · medium

   A security team wants to review emails that might contain malware or phishing links before they are delivered to users. They also want to allow users to self-release false positives. What should you implement?

   • ASet up a mail policy that deletes all messages with links.
   • BImplement SPF and DKIM to authenticate senders.
   • CEnable DLP to block messages with sensitive data.
   • DConfigure a quarantine policy that holds suspicious messages and provides end-user release notifications.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to ensure that emails sent from their domain are not tampered with and that recipients can verify the sender. They already have SPF configured. What additional mechanism should they implement to sign their emails?

   • AEnable TLS for outbound email to encrypt messages.
   • BConfigure DMARC to reject messages that fail SPF.
   • CImplement DKIM by generating a key pair and adding the public key to DNS.
   • DCreate a mail policy that adds a disclaimer to all outbound emails.
   Reveal Solution Discussion Select an answer first