312-50 Question 463
Single answer▪ Email EncryptionDuring a security assessment, you discover that a company sends sensitive incident reports between its internal security team and an external legal firm using standard SMTP. Management wants a solution that protects the contents of the messages even if they are stored on an intermediate mail server or forwarded outside the organization. They also want recipients to be able to verify who sent the message and whether it was modified in transit. Which option BEST meets these requirements?
- A
Implement S/MIME so messages are encrypted with the recipient's public key and digitally signed with the sender's private key
- B
Enable STARTTLS on the mail servers so all email remains encrypted end-to-end after delivery and forwarding
- C
Configure SPF, DKIM, and DMARC because they encrypt message bodies and attachments while validating sender identity
- D
Use a VPN between the company and the legal firm because this guarantees message confidentiality and integrity after the email reaches either mailbox
Show answer and explanation
Correct answer: A
Explanation
The best answer is S/MIME because the scenario requires protection that survives beyond transport: the message must remain protected even if stored on intermediate servers or forwarded. That is a classic need for end-to-end, message-level email encryption rather than only transport-layer protection. S/MIME uses X.509 certificates to encrypt email to the recipient and to apply digital signatures from the sender, supporting confidentiality, integrity, authentication, and non-repudiation characteristics. By contrast, STARTTLS protects SMTP hops in transit but not the message at rest after delivery. SPF, DKIM, and DMARC help validate sender legitimacy and reduce spoofing but are not confidentiality controls. A VPN secures the communication channel, not the email object itself. This aligns with standard email security best practices and common guidance from vendors and standards bodies describing S/MIME as a message-level security mechanism, while TLS-based SMTP is transport protection only.
- A. Correct.
Correct. S/MIME provides message-level encryption and digital signatures using public key cryptography. Encrypting with the recipient's public key helps ensure that only the intended recipient can decrypt the message, even if the message is stored on a mail server or intercepted after transit. Digitally signing with the sender's private key allows the recipient to verify the sender's identity and detect tampering. This directly addresses confidentiality, authenticity, and integrity at the message level.
- B. Incorrect.
Incorrect. STARTTLS protects email in transit between mail servers or between a client and server, but it does not provide persistent end-to-end protection of the message content once the email is delivered or stored. If a message is forwarded, stored on an intermediate system, or accessed from a compromised mailbox, STARTTLS alone does not keep the content encrypted in the way requested.
- C. Incorrect.
Incorrect. SPF, DKIM, and DMARC are email authentication and anti-spoofing controls. SPF checks whether a sending server is authorized, DKIM provides a cryptographic signature for selected message elements, and DMARC defines policy and reporting around SPF/DKIM results. They do not encrypt message bodies or attachments for confidentiality, so they do not meet the requirement to protect sensitive content on intermediate servers.
- D. Incorrect.
Incorrect. A VPN can encrypt traffic between networks or endpoints during transport, but it does not provide message-level encryption after the email is received by the mail system. Once the email reaches a mailbox or is stored on a server, the VPN no longer protects the message itself. It also does not inherently provide sender-level digital signatures for the email content.