312-50 Question 464
Single answer▪ Email EncryptionA security consultant is assessing how a company protects sensitive financial reports sent by email to external auditors. The company currently relies on SMTP over TLS (STARTTLS) between mail servers and assumes this means only the intended recipient can read the message. During the assessment, the consultant explains that messages may still be accessible on intermediate mail servers or in recipient mailboxes after delivery. Which solution would BEST provide end-to-end confidentiality so that only the intended recipient can decrypt the email content?
- A
Implement S/MIME and encrypt the message with the recipient's public key
- B
Require all outbound mail servers to use STARTTLS with strong cipher suites
- C
Digitally sign all emails with DKIM and SPF records enabled
- D
Use a VPN between the sender's network and the recipient's mail server
Show answer and explanation
Correct answer: A
Explanation
The best answer is S/MIME with recipient public-key encryption because the scenario specifically requires end-to-end confidentiality of email content. CEH candidates should recognize the distinction between transport-layer protection and message-layer protection. STARTTLS secures SMTP sessions hop by hop, which is valuable, but it does not prevent exposure at relays, gateways, or mailbox storage. By contrast, S/MIME encrypts the message itself so that only the holder of the corresponding private key can decrypt it. This aligns with standard email security best practices and common enterprise deployments. Relevant references include RFC 5751 for Secure/Multipurpose Internet Mail Extensions (S/MIME) and general guidance from NIST on using cryptographic mechanisms appropriate to the data protection objective. DKIM, SPF, and VPNs improve other aspects of mail security, but they do not satisfy the stated requirement of restricting message readability to the intended recipient.
- A. Correct.
Correct. S/MIME provides end-to-end email encryption by using the recipient's public key to encrypt the message so that only the recipient, who possesses the corresponding private key, can decrypt it. This addresses the core issue in the scenario: protecting message content beyond transport and across mail storage points. In practice, S/MIME also supports signing for integrity and authenticity, but its encryption capability is what directly solves the problem described.
- B. Incorrect.
Incorrect. STARTTLS protects email in transit between SMTP servers, reducing the risk of interception on the network path. However, it does not provide true end-to-end encryption because messages are decrypted and re-encrypted at each mail hop and may be stored in readable form on intermediate or destination mail servers. This is a common misconception when organizations confuse transport security with message-level confidentiality.
- C. Incorrect.
Incorrect. DKIM and SPF help validate sending domains and reduce spoofing, phishing, and unauthorized use of mail domains, but they do not encrypt message content. DKIM adds a cryptographic signature to support integrity and domain authenticity, while SPF is a policy mechanism for sender authorization. Neither ensures that only the intended recipient can read the email body.
- D. Incorrect.
Incorrect. A VPN can protect traffic between two network points, but it does not provide message-level end-to-end encryption for email once the message reaches a mail server. The email may still be processed, stored, forwarded, or accessed in plaintext at server endpoints. This option improves network confidentiality for a segment of the path, not the confidentiality of the email content itself from sender to recipient.