312-50 Question 462
Single answer▪ Email EncryptionDuring a security assessment, a company tells you that employees regularly send contracts and customer data to external partners by email. The organization wants to ensure that only the intended recipient can read the message contents, even if the email is intercepted in transit or stored on a third-party mail server. Which solution best meets this requirement while still allowing messages to be sent through standard email infrastructure?
- A
Implement end-to-end email encryption using S/MIME with the recipient's public certificate
- B
Enable STARTTLS on the company's SMTP server so all outbound email is encrypted
- C
Protect the email account with multifactor authentication to prevent unauthorized logins
- D
Configure SPF, DKIM, and DMARC on the domain to secure outbound email delivery
Show answer and explanation
Correct answer: A
Explanation
The key requirement in this scenario is confidentiality of the email content beyond the transport path. Transport-layer protections such as SMTP over TLS or STARTTLS protect email only while it moves between systems, but they do not ensure that stored email remains unreadable to intermediaries. End-to-end email encryption, such as S/MIME or OpenPGP, is designed for this exact use case. S/MIME uses X.509 certificates and public key cryptography so the sender can encrypt a message with the recipient's public key, ensuring only the intended recipient can decrypt it with their private key. This aligns with common enterprise email encryption practices and guidance from standards and vendor documentation for secure messaging. By contrast, SPF, DKIM, and DMARC support anti-spoofing and domain authentication, and MFA protects account access, but neither addresses message confidentiality.
- A. Correct.
Correct. S/MIME provides end-to-end encryption for email content by allowing the sender to encrypt the message with the recipient's public key. Only the recipient, who possesses the corresponding private key, can decrypt and read the message. This protects confidentiality even if the message is intercepted during transit or stored on intermediate mail servers.
- B. Incorrect.
Incorrect. STARTTLS helps encrypt the transport channel between mail servers when supported, but it does not provide end-to-end protection for the message content. Once the message reaches a mail server, it may be stored in readable form unless an end-to-end mechanism such as S/MIME or OpenPGP is used.
- C. Incorrect.
Incorrect. Multifactor authentication protects access to the sender's or recipient's mailbox, which is important for account security, but it does not encrypt the contents of individual email messages. If the message is intercepted or accessed on a mail server, MFA does not preserve message confidentiality.
- D. Incorrect.
Incorrect. SPF, DKIM, and DMARC improve email authentication and help reduce spoofing and phishing, but they do not encrypt email content. These controls address sender validation and message integrity policies, not confidentiality of the message body or attachments.