220-1102 Question 423
Single answerEmail security gatewayA company recently deployed an email security gateway in front of its mail server after several users received phishing messages with malicious links. Management wants to reduce the number of dangerous emails reaching inboxes without blocking normal business communication. Which action should the technician configure on the email security gateway FIRST to best address this problem?
- A
Enable URL reputation and link scanning on inbound email messages
- B
Disable SMTP on the internal mail server so users can only use webmail
- C
Require all employees to use a VPN before opening email attachments
- D
Create a local hosts file entry on each workstation for known phishing domains
Show answer and explanation
Correct answer: A
Explanation
The best first step is to configure the email security gateway to inspect inbound messages for malicious links using URL reputation, anti-phishing, or link analysis features. Email security gateways are designed to filter spam, malware, spoofing attempts, and phishing content before mail reaches end users. In real environments, technicians typically use gateway controls such as URL filtering, attachment sandboxing, sender reputation, and anti-spoofing standards like SPF, DKIM, and DMARC to reduce email-based threats while preserving business communication. This aligns with common email security best practices from major vendors and industry guidance, including recommendations from CISA and NIST to use layered email protections and filter phishing content at the mail gateway.
- A. Correct.
Correct. An email security gateway is commonly used to inspect inbound mail for phishing indicators, including malicious or suspicious URLs. Enabling URL reputation and link scanning helps identify and quarantine messages containing links to known bad or newly suspicious sites before they reach users. This is a practical first control because the stated issue is phishing emails with malicious links, and this feature is specifically designed to reduce that risk while allowing legitimate email traffic to continue.
- B. Incorrect.
Incorrect. Disabling SMTP on the internal mail server would prevent normal mail flow and does not address the phishing detection capabilities of the email security gateway. SMTP is required for standard email transport between servers. This option reflects a misunderstanding between email delivery protocols and security filtering controls.
- C. Incorrect.
Incorrect. A VPN secures network connectivity, especially for remote access, but it does not analyze whether an email attachment or embedded link is malicious. Requiring a VPN before opening attachments would add inconvenience without solving the stated problem. This distractor targets the common misconception that VPNs are a general-purpose protection against all cyber threats.
- D. Incorrect.
Incorrect. A hosts file entry can map a domain name to an IP address locally, but manually managing phishing domains on every workstation is not scalable, easy to bypass, and does not use the centralized protections of the email security gateway. It also would not effectively catch new phishing domains or rewritten links in email.