200-201 Question 293
Select 3A cybersecurity analyst is investigating a suspected phishing attack involving email communication. During the analysis, the analyst notices unusual traffic on port 110 and confirms that the organization uses both POP3 and IMAP for email retrieval. Which of the following actions should the analyst prioritize to secure email communication?
- A
Ensure that POP3 and IMAP traffic is encrypted via SSL/TLS.
- B
Block all traffic on port 143 to prevent IMAP access.
- C
Inspect email headers for signs of spoofing or phishing indicators.
- D
Disable POP3 and IMAP entirely in favor of SMTP for secure email retrieval.
- E
Monitor and log email traffic for malicious attachments or links.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure email communication during a phishing investigation, the analyst should ensure encryption for POP3/IMAP traffic to protect data in transit, inspect email headers for phishing indicators to identify malicious activity, and monitor email traffic for malicious content. These steps collectively help mitigate risks associated with email-based threats while maintaining legitimate functionality.
- A. Correct.
Ensuring POP3 and IMAP traffic is encrypted via SSL/TLS is a critical step to prevent credentials and sensitive data from being intercepted during transmission.
- B. Incorrect.
Blocking all traffic on port 143 would disable IMAP access entirely, which might disrupt legitimate email communication. This is not a practical solution unless IMAP is intentionally decommissioned.
- C. Correct.
Inspecting email headers can help identify spoofing or phishing attempts, which are common in email-based attacks.
- D. Incorrect.
Disabling POP3 and IMAP entirely in favor of SMTP is not a valid solution as SMTP is used for sending email, not retrieval. POP3 and IMAP are necessary for retrieving emails.
- E. Correct.
Monitoring and logging email traffic for malicious attachments or links is an essential practice for identifying and mitigating email-borne threats.