📝 Email security protocols (14 MCQs)
📖 From Data Communication and Networks • 32. Internet Security • 14 questions available
What is Email security protocols?
Email security protocols are specialized standards designed to protect electronic mail from eavesdropping, tampering, and spoofing by providing encryption, digital signatures, and authentication mechanisms tailored for email systems.
📝 All Email security protocols MCQs
Q1. If an organization disables TLS for outgoing mail, which security property is most directly compromised?
📖 Explanation: Disabling TLS removes the encryption that protects data while it travels between mail servers. Without TLS, the message payload can be read by anyone who intercepts the traffic, directly compromising confidentiality. Integrity and non‑repudiation may still be provided by other mechanisms, but the most immediate loss is the ability to keep the content secret.
Q2. A user receives an email that appears to come from their bank, but the embedded link points to a domain with a typo. Which inference best explains the attacker’s intent?
📖 Explanation: A link that points to a misspelled domain is a classic indicator of a credential‑harvesting attempt. Attackers rely on users not noticing the subtle typo, leading them to a counterfeit site where login details are entered. While malware delivery is possible, the primary goal inferred from the typo is to steal credentials.
Q3. Suppose an email system uses arithmetic coding to compress message bodies before encryption. If an attacker can infer the interval boundaries, what can they deduce about the original message?
📖 Explanation: Arithmetic coding maps the entire message to a sub‑interval of . If an attacker can determine the interval boundaries, they can infer the probability distribution of symbols used, revealing patterns such as frequent words or file types. Although they may not recover the exact plaintext, the statistical profile can aid further cryptanalysis.
Q4. Compare SPF and DKIM. Which statement correctly describes their primary validation functions?
📖 Explanation: SPF checks whether the sending IP address is authorized to send mail for the claimed domain, while DKIM validates a digital signature that covers the message body and selected headers. This distinction means SPF focuses on the envelope sender’s network legitimacy, whereas DKIM assures the integrity and authenticity of the content itself.
Q5. When choosing between S/MIME and OpenPGP for securing corporate email, which factor most influences the decision for a large enterprise?
📖 Explanation: Large enterprises often need a single authority to create, distribute, and revoke certificates for many users. S/MIME integrates with corporate PKI, enabling centralized key management, policy enforcement, and audit trails. OpenPGP, being decentralized, lacks this administrative control, making S/MIME the preferred choice for enterprise‑wide deployments.
Q6. Differentiate the protection offered by TLS at the transport layer from that provided by S/MIME at the application layer in the context of email forwarding.
📖 Explanation: TLS encrypts the channel between two mail servers, protecting data only while it is in transit; once the message reaches an intermediate server, TLS protection ends and the data is exposed. In contrast, S/MIME encrypts the message itself, preserving confidentiality and integrity across every hop, including any forwarding or storage operations.
Q7. Applying the principle of least privilege to an email server, which configuration best exemplifies this principle?
📖 Explanation: Granting the mail service only the minimum file‑system permissions required to read incoming mail and write outgoing mail, without administrative or system‑wide rights, embodies the principle of least privilege. This limits the impact of a compromised mail process, preventing it from altering system configurations or accessing unrelated data.
Q8. How does arithmetic coding affect the entropy of an email attachment, and what security implication does this have for side‑channel analysis?
📖 Explanation: Arithmetic coding reduces redundancy by assigning shorter codes to more probable symbols, thereby lowering the overall entropy of the compressed attachment. Because the resulting bitstream reveals fewer statistical clues about the original content, side‑channel attacks that rely on frequency analysis become more difficult, enhancing confidentiality.
Q9. Design a policy that combines DMARC enforcement with content‑filtering rules to reduce successful phishing attempts. Which statement best captures the policy’s core mechanism?
📖 Explanation: The policy mandates that any message failing DMARC alignment be rejected outright, while also subjecting all inbound attachments to a content‑filtering engine that scans for malicious macros, scripts, or embedded executables. By coupling domain‑authentication enforcement with deep‑packet inspection, the organization blocks both spoofed phishing emails and malicious payloads.
Q10. What is the most common definition of phishing in cybersecurity?
📖 Explanation: Phishing is defined as a fraudulent attempt to obtain sensitive information—such as usernames, passwords, or financial details—by masquerading as a trustworthy entity in electronic communications, typically email. The attacker exploits the victim’s trust to trick them into revealing confidential data.
Q11. If an email gateway logs a sudden increase in SPF failures from a single IP range, what is the most likely cause?
📖 Explanation: A spike in SPF failures from a specific IP range indicates that those servers are sending mail claiming to be from domains they are not authorized to represent. This pattern commonly arises when attackers use compromised or rented IP addresses to spoof legitimate senders, leading to a surge in authentication failures.
Q12. Evaluate the impact of disabling DKIM signing on a mail flow that already uses DMARC with a 'reject' policy. Which outcome is most probable?
📖 Explanation: DMARC with a ‘reject’ policy requires either SPF or DKIM to pass and align with the visible From address. If DKIM signing is disabled, only SPF can satisfy DMARC. When SPF also fails alignment, the DMARC engine will reject the message, causing delivery failures for all affected emails.
Q13. Synthesize a multi‑factor authentication workflow for accessing webmail that also incorporates anomaly detection based on email sending patterns. Which step should be placed immediately after successful password entry?
📖 Explanation: After the password is verified, the system should invoke a risk‑assessment engine that evaluates recent sending behavior, such as unusual volume or atypical recipient domains. This anomaly detection step determines whether additional factors—like a one‑time code or biometric check—are needed before granting full webmail access.
Q14. An organization implements both S/MIME encryption and TLS for email transmission. If an attacker obtains the TLS private key but not the S/MIME private key, which confidentiality guarantees remain intact?
📖 Explanation: S/MIME encrypts the email content itself, meaning the message remains unreadable without the recipient’s private key. Even if an attacker obtains the TLS private key and can decrypt the transport layer, the inner S/MIME layer still protects the payload, preserving confidentiality for the email body and attachments.)