A user clicks a link in a phishing email that slipped past the email filters. The link points to a credential-harvesting site that threat intelligence already lists as malicious. Which network-layer control can still stop the connection after the click?
Select an answer to reveal the explanation.
Short Explanation
The email got through, but the browser still has to ask DNS where that site lives. DNS-layer security answers with a block page instead of the attacker's address, so the connection never happens. The trap is DMARC; it works at delivery, and you're past that point.
Full Explanation
DNS-layer security inspects the domain lookups that precede almost every connection. When a user clicks a link, the device first resolves the hostname; a protective resolver, such as the DNS security in Cisco Secure Access, compares the domain against threat intelligence and either refuses resolution or returns the address of a block page for malicious categories such as phishing. Because it operates at the lookup, it protects every application and port without decrypting traffic, and it still works after an email filter has failed, which makes it a strong layered control. DMARC is applied by receiving mail servers at delivery and only protects the company's own domain from exact spoofing; once a message is in the mailbox and clicked, DMARC has no further role, and a phishing lure usually comes from an unrelated domain. An IPS inspects network traffic for exploit patterns; it does not act within an email client to drop a message body, and a credential-harvesting page is not an exploit. 802.1X authenticates devices to the network at the switch port and does not evaluate the destinations an authenticated device visits. Exam caveat: DNS-layer blocking is bypassed if a client uses hard-coded IP addresses or an unmanaged encrypted resolver. Operational check: test resolution of a known test phishing domain and confirm the block page appears.