CHAPTER 10 – E-MAIL SECURITY
TRUE/FALSE
1. MIME is designed for the exchange of electronic mail between networked systems, particularly via the
Internet.
2. POP3 is popular among many ISPs because it is designed so that messages are downloaded to an inbox
on the client’s computer, rather than being stored on the e-mail server after they are accessed.
3. When e-mail is accessed on an e-mail server using POP3, only the message headers are initially
downloaded to the client.
4. A common way to attack SMTP is an indirect attack through a DNS server.
5. A local delivery agent is used to transmit an e-mail message.
6. One way to help control UCE is for an organization to ensure that its mail servers are not configured as
open SMTP relay servers.
7. Authenticating e-mail is one of the most effective ways to ensure the privacy of messages while they
are in transit and after they arrive at an SMTP server.
8. When using only SMTP, no line can be longer than 1000 characters.
9. In terms of encryption, the original S/MIME version used a 56-bit encryption method, called RC3.
10. PGP enables the use of X.509 or PGP digital certificates, which are essentially public keys given to the
recipient of the e-mail communication.
MODIFIED TRUE/FALSE
1. A(n) host address resource record associates a particular TCP/IP service to a server.
_________________________
2. EBlock works with Microsoft’s Internet Mail Service to create a list of sources from which to refuse e-
mail. _________________________
3. The MIME extensions are provided to enable 8-bit binary encoding, and they enable the sending of
multipart messages. _________________________
4. PKCS is a proprietary encryption method developed by RSA Security as an alternative to DES.
_________________________
5. CAST was developed by Xuejia Lai and James Massey and uses a 128-bit key.
_________________________
6. GPG is a security method that is designed to be compatible with PGP. _________________________
7. A valuable security feature of Apple Mail is that you can create rules to reject mail from unwanted or
unknown sources. _________________________
8. Apple Mail uses PGP for security and enables you to specify use of SSL for security over Internet
links to e-mail. _________________________
9. SMTP was proposed in 1982 by Jon Postel and began, in part, as an alternative to FTP for sending a
file from one computer system to another. _________________________
10. SMTP is a client and server process. _________________________
MULTIPLE CHOICE
1. SMTP was proposed in _____ by Jon Postel and began, in part, as an alternative to FTP for sending a
file from one computer system to another.
a.
1972
c.
1992
b.
1982
d.
2002
2. Which of the following ports is required for a user to send e-mail via SMTP?
a.
25
c.
110
b.
23
d.
443
3. How many parts does each SMTP message have?
a.
1
c.
3
b.
2
d.
4
4. What type of encoding is used by SMTP?
a.
7-bit ASCII
c.
11-bit ASCII
b.
7-bit binary
d.
11-bit binary
5. SMTP processes e-mail through a queue that serves as a _____ for users that connect to that server.
a.
home base
c.
post office
b.
resource center
d.
library
6. In an SMTP address header, the _____ is the dotted-decimal address of the SMTP server.
a.
envelope
c.
host names
b.
message header
d.
domain literal
7. In an SMTP address header, the _____ is the name of the SMTP post office server used to transmit and
receive the e-mail.
a.
domain name
c.
host name
b.
server name
d.
post office name
8. Which of the following information is contained in an SMTP message header?
a.
To:
d.
Subject:
b.
From:
e.
All of the above
c.
Date:
9. Which TCP port is used for POP3?
a.
25
c.
109
b.
100
d.
110
10. Which TCP port is used for POP2?
a.
23
c.
110
b.
109
d.
125
11. Which protocol enables e-mail to be received and stored on an SMTP server and allows clients to
obtain their messages?
a.
MIME
c.
X.400
b.
S/MIME
d.
IMAP
12. What TCP port does IMAP use?
a.
25
c.
110
b.
109
d.
143
13. What is the most current version of IMAP?
a.
2
c.
4
b.
3
d.
5
14. Looking up a computer on the basis of its name and then associating that name with an IP address is
accomplished by defining a DNS _____.
a.
host address resource record
c.
pointer resource record
b.
service locator record
d.
location resource record
15. To look up a computer name on the basis of its IP address, a DNS _____ is configured on the DNS
server.
a.
location resource record
c.
service locator record
b.
host address resource record
d.
pointer resource record
16. A _____ associates a particular TCP/IP service to a server along with the domain of the server and its
protocol.
a.
pointer resource record
c.
service locator record
b.
host address resource record
d.
server locator record
17. What command does an attacker use to send the contents of a malicious file into the port-scanning
software, directing the port scanner to send it to the target SMTP server on port 25?
a.
send
c.
grep
b.
post
d.
pipe
18. When an e-mail message is sent, what type of program is used to compose and read an e-mail
message?
a.
Mail user agent
c.
Local delivery agent
b.
Message transfer agent
d.
Mail reader agent
19. When an e-mail message is sent, what type of program is used to place a new message into a particular
user’s mailbox?
a.
Message transfer agent
c.
Local delivery agent
b.
Mail user agent
d.
Message placement agent
20. When an e-mail message is sent, what type of program is used to transmit the e-mail message?
a.
Message transmission agent
c.
Local delivery agent
b.
Message transfer agent
d.
Mail user agent
21. Which of the following is unrequested e-mail that is sent to hundreds, thousands, or even millions of
users?
a.
USE
c.
Trash
b.
Spam
d.
Crud
22. Which of the following e-mail encryption method is recommended by many security professionals?
a.
S/MIME
d.
Both a and b
b.
PGP
e.
Both b and c
c.
MIME
23. _____ provides extensions to the original SMTP address header information so that many different
types of message content can be encoded for transport over the Internet.
a.
MIME
c.
PGP
b.
POP3
d.
PPL
24. What type of encoding is used with MIME?
a.
Base16
c.
Base64
b.
Base32
d.
Base128
25. What is the maximum length of a message line when using SMTP only?
a.
100 characters
c.
500 characters
b.
256 characters
d.
1000 characters
26. Which of the following is an example of a Commercial CA?
a.
GCFN
c.
Thawte
b.
GTE CyberTrust
d.
All of the above
27. In 2002, which type of security was added to S/MIME?
a.
40-bit DES
c.
128-bit key triple DES
b.
56-bit DES
d.
168-bit key triple DES
28. In PGP, what CAST variable key length is available?
a.
32 bits
d.
Both a and b
b.
56 bits
e.
Both b and c
c.
128 bits
29. What is the name of the e-mail tools used in Mac OS X?
a.
Ximian
c.
MailX
b.
Pine
d.
Mail
30. Which of the following e-mail security features offered by Microsoft Outlook are proprietary to
Microsoft exchange?
a.
V1 Exchange Server Security certificates
b.
X2 Exchange Server Security certificates
c.
Digital signatures encrypted using the Security Hash Algorithm 1
d.
168-bit Exchange Server mail encryption services
31. In Microsoft Outlook, into which file types can you import messages?
a.
Text file
d.
Both a and b
b.
Microsoft Access file
e.
Both b and c
c.
Microsoft Word file
32. Which of the following encryption methods are supported by GPG?
a.
Twofish
d.
Both a and b
b.
Blowfish
e.
Both b and c
c.
IDEA
33. In the figure above, where is an attacker most likely to attempt to intercept e-mail transmissions?
a.
Between A and B
c.
Between C and D
b.
Between B and C
d.
At D
34. What is displayed in the figure above?
a.
Outlook Express
c.
Evolution Mail configuration options
b.
Apple Mail
d.
Evolution Mail Summary view
35. What is displayed in the figure above?
a.
Evolution Mail Summary view
c.
Outlook Express
b.
Apple Mail
d.
Eudora
YES/NO
1. Is the goal of SMTP to provide reliable and guaranteed message transport?
2. Does a DNS server convert a computer or domain name to an IP address, or an IP address to a
computer or domain name, in a process called resolution?
3. Do direct attacks on SMTP typically come from client e-mail software such as Outlook, Evolution, or
Apple Mail?
4. Is unsolicited commercial e-mail very expensive for organizations?
5. Does SMTP support the transmission of ASCII text as well as binary file?
6. Does PGP security rely strictly on the use of X.509 digital certificates?
7. Is IDEA well respected as a very secure patented block cipher encryption method?
8. In an SMTP message, are the address header and the message text both encoded in 15-bit ASCII
format?
9. Does POP work through TCP port 109 for POP2 to enable an SMTP server to receive, store, and allow
clients to retrieve their messages?
10. Does all software that sends e-mail through the Internet use SMTP?
COMPLETION
1. SMTP does not require use of a(n) ____________________ and password for the remote system.
2. POP and IMAP are designed to enable ____________________ and retrieval of e-mail messages.
3. An SMTP address header ____________________ contains the source and destination e-mail
addresses.
4. Using POP3 can be a disadvantage for ____________________, because messages are not previewed
before they are downloaded.
5. When using IMAP, the ____________________ command chooses a folder from which to determine
the available messages.
6. When a computer sends e-mail, the message goes to a(n) ____________________ server that looks up
the SMTP server on its network and enables the message to be directed to that server.
7. Sending a malicious SMTP message from a UNIX/Linux operating system is easier, because the
attacker simply uses e-mail ____________________ options already built into UNIX/Linux.
8. When an e-mail message is sent, a(n) ____________________ is used to place a new message into a
particular user’s mailbox.
9. E-mail encryption reduces the chance that someone can forge an e-mail, because both the sender and
the recipient must be using the same encryption ____________________ and the same encryption
method.
10. In 1998, 40-bit and 56-bit DES encryption techniques were added to ____________________.
MATCHING
Match the following terms to the appropriate definition.
a.
GPG
f.
POP
b.
Host address (A) resource record
g.
PGP
c.
Host address (AAAA) resource record
h.
PKCS
d.
Open SMTP relay server
i.
S/MIME
e.
PTR resource record
j.
SRV locator record
1. Consists of a computer or domain name mapped to a 128-bit address
2. Consists of an IP address correlated to a computer or domain name
3. Standards developed by RSA Laboratories and other security organizations for public-key security
methods
4. A DNS server record that associates a particular TCP/IP service to a server
5. Consists of a computer or domain name correlated to a 32-bit address
6. E-mail security method sometimes preferred by the open systems community
7. An e-mail server that resends e-mail to other servers without restrictions
8. An encryption and certificate-based security technique for e-mail messages
9. Gives an SMTP server the ability to receive and store e-mail
10. A security method that is designed to be compatible with PGP
SHORT ANSWER
1. What six pieces of information are contained in a PGP digital certificate?
2. What are three e-mail security measures that organizations can take to protect its users and computers?
3. If an organization decides to use an e-mail gateway with virus scanning software, what four features
should they look for in the software?
4. List five ways users can protect themselves from malicious e-mail attachments.
5. List four popular e-mail tools that are in use today.
6. List four of the e-mail communication security measures that are supported by Outlook Express.
7. List five of the e-mail security features that are offered through Microsoft Outlook.
8. What four authentication methods can Apple Mail use for verifying access to an e-mail account?
9. List five pieces of information that an SMTP address header may contain.
10. List six e-mail server software systems that are used for processing SMTP mail messages.