220-1101 Question 100
Single answerSpam gatewaysA small accounting firm recently deployed a cloud-based spam gateway in front of its mail server after users reported a large increase in phishing emails. Two days later, several legitimate messages from a long-time client are not reaching users' inboxes. The client says the messages were sent successfully and did not bounce back. Which action should the technician take FIRST to identify whether the spam gateway is causing the problem?
- A
Review the spam gateway's message tracking or quarantine logs for the client's sender address or domain
- B
Disable the spam gateway temporarily and ask the client to resend all missing messages
- C
Reinstall the email client on the affected users' workstations
- D
Change the firm's public IP address and update DNS records
Show answer and explanation
Correct answer: A
Explanation
When legitimate email goes missing shortly after a spam gateway is introduced, the most efficient and least disruptive first step is to verify what the gateway did with the message. Most spam gateways provide quarantine views, message trace tools, and filtering logs that show whether a message was accepted, rejected, quarantined, or delivered. In a real support scenario, a technician would search by sender address, recipient, subject, or time range, then determine whether the message was blocked by spam scoring, attachment policy, spoofing checks, or another rule. If the gateway quarantined the message, the next step may be to release it and add a safe sender or allow-list entry if appropriate. This aligns with common vendor best practices from email security platforms and mail hygiene services: review message trace/logs first, confirm filtering action, and then adjust policy rather than disabling protection or troubleshooting the endpoint prematurely.
- A. Correct.
Correct. The first step is to check the spam gateway's message tracking, filtering, or quarantine logs to see whether the messages were received and then blocked, quarantined, or tagged by policy. Spam gateways are specifically designed to inspect and filter inbound mail before it reaches the mail server or user mailbox, so their logs are the most direct place to confirm whether the gateway is responsible.
- B. Incorrect.
Incorrect. Temporarily disabling the spam gateway is risky and not the best first troubleshooting step because it exposes users to unwanted or malicious email and bypasses an important security control. Best practice is to investigate logs and quarantine first, then adjust allow lists, policies, or sender reputation settings if needed.
- C. Incorrect.
Incorrect. Reinstalling the email client would not address mail that never reached the inbox in the first place. Since the sender reports successful transmission and there is no bounce message, the issue is more likely upstream in mail filtering or delivery rather than with the local email application.
- D. Incorrect.
Incorrect. Changing the firm's public IP address and DNS records is unrelated to diagnosing missing inbound messages from one specific sender after deployment of a spam gateway. This option reflects a misunderstanding of how spam gateways work; they filter messages based on content, reputation, policy, and sender information rather than requiring a public IP change for normal troubleshooting.