Which Measure Best Prevents Email-Delivered Targeted Malware Attacks?

312-50v12 By islever Editorial Last updated

Malware Threats Social Engineering

Short answer

D Applying the latest patches and updating software programs closes exploit paths used by suspicious email attachments and is the best preventive measure.

Question

Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?
  1. Disabling Autorun functionality on all drives
  2. Avoiding the use of outdated web browsers and email software
  3. Regularly scan systems for any new files and examine them
  4. Applying the latest patches and updating software programs Correct Answer

Key Takeaways

The question tests preventive versus detective controls for email-borne malware, and the trap is choosing file scanning or Autorun changes, which do not stop an attachment from exploiting an unpatched system.

This CEH 312-50v12 item examines how to prevent targeted malware delivered through suspicious email attachments. The page establishes that applying the latest patches and updating software programs (D) is the strongest preventive measure among the listed choices.

Common mistake: A frequent mistake is choosing C, regularly scanning systems for new files, because it sounds proactive; however, scanning is mostly detective and occurs after the malicious attachment has already landed or executed.

Expert Analysis

Why the Answer Is Correct

Applying the latest patches and updating software programs is the broadest preventive control listed. Email-delivered malware often relies on known vulnerabilities in operating systems, browsers, email clients, and document readers, so patching closes those exploit paths before a user opens the attachment. CEH exam doctrine favors eliminating the underlying vulnerability over relying on user behavior or after-the-fact inspection. Even a targeted attack becomes much less likely to succeed when the exposed software stack is fully updated. This matches the unanimous learner support for D.

Why the Other Options Are Wrong

Disabling Autorun only limits automatic execution from removable drives and does not stop an email attachment from being opened. Avoiding outdated browsers and email software sounds close, but it is narrower and less operational than a full patch-and-update program covering all software. Regularly scanning for new files is a detective control that may miss zero-day, polymorphic, or obfuscated malware and does not prevent the initial execution. None of these options addresses the exploitation of unpatched vulnerabilities as directly as D.

Community Comment Notes

insaniunt argued that "Applying the latest patches and updating software programs is essential" and tied it to protection from known vulnerabilities. LordXander added that "is D based on CEHv12 1187", indicating the source question maps to answer D in the CEH v12 bank. Other learners simply asked for confirmation, so the comment thread shows consensus but little independent debate. The community evidence aligns with the technical analysis above.

Official Reference

https://csrc.nist.gov/pubs/sp/800/40/r4/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a CEH question asks for the most effective prevention, separate preventive controls from detective controls. Pick the answer that removes the vulnerability or blocks the attack path, not one that only finds files after execution.

Frequently Asked Questions

Why isn't regularly scanning for new files the best prevention for email malware?

Scanning is mainly detective and occurs after the attachment lands or runs, so it may miss zero-day or obfuscated malware. Patching closes the vulnerabilities that let the payload execute.

Does disabling Autorun stop malware delivered in an email attachment?

No. Autorun settings control removable drives and optical media; they do not stop a user from opening an email attachment or a document that exploits an unpatched application.

More 312-50v12 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. insaniunt 👍 4 Answered D
    The most effective measure to prevent such attacks is D. Applying the latest patches and updating software programs is essential to keep the systems secure and protected from known vulnerabilities that attackers can exploit.
  2. LordXander 👍 2 Answered D
    Can confirm, is D based on CEHv12 1187
  3. [Removed] 👍 1
    Hey friends can we make sure this is correct
  4. [Removed] 👍 1
    Team can you confirm if this is accurate

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide