A malicious attachment passes the email security layer because its file hash was unknown when the message was delivered. A user opens it on a Windows laptop. Which additional defense-in-depth layer is most likely to stop the file from executing on that host?
Select an answer to reveal the explanation.
Short Explanation
Defense in depth is like a castle with a moat and guards inside the keep: when something swims past the moat, you want someone waiting at the door. Once the file is already on the laptop, only a control on that laptop can stop it running. Don't fall for adding more mail filtering; the message has already been delivered.
Full Explanation
Defense in depth assumes that any single layer will eventually miss something, so independent controls are placed at successive points in the attack chain. Email security inspects messages in transit, but an unknown file can pass it. The next opportunity to intervene is on the endpoint, where an endpoint protection platform such as Cisco Secure Endpoint evaluates the file when it is written or executed, using cloud reputation, machine-learning engines and behavioral protection, and can quarantine it or block the process. A second email gateway in series acts at the same point in the chain as the first, before delivery, and cannot act on a file a user has already opened. Blocking inbound SMTP from unknown sender domains is a perimeter control that would also cut off legitimate mail and does nothing once the attachment is on disk. DMARC published for the organization's own domain protects others from spoofing of that domain; it does not inspect inbound attachments or stop execution. Exam caveat: the stem's timing (already delivered, already opened) is what eliminates every pre-delivery control. Operational check: confirm the endpoint connector is installed and its policy is in a blocking mode on the laptop, then review its events for the file's hash and the quarantine action.