Which Measure Best Prevents Email-Delivered Targeted Malware Attacks?
Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests preventive versus detective controls for email-borne malware, and the trap is choosing file scanning or Autorun changes, which do not stop an attachment from exploiting an unpatched system.
This CEH 312-50v12 item examines how to prevent targeted malware delivered through suspicious email attachments. The page establishes that applying the latest patches and updating software programs (D) is the strongest preventive measure among the listed choices.
A frequent mistake is choosing C, regularly scanning systems for new files, because it sounds proactive; however, scanning is mostly detective and occurs after the malicious attachment has already landed or executed.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Applying the latest patches and updating software programs is the broadest preventive control listed. Email-delivered malware often relies on known vulnerabilities in operating systems, browsers, email clients, and document readers, so patching closes those exploit paths before a user opens the attachment. CEH exam doctrine favors eliminating the underlying vulnerability over relying on user behavior or after-the-fact inspection. Even a targeted attack becomes much less likely to succeed when the exposed software stack is fully updated. This matches the unanimous learner support for D.Why the Other Options Are Wrong
Disabling Autorun only limits automatic execution from removable drives and does not stop an email attachment from being opened. Avoiding outdated browsers and email software sounds close, but it is narrower and less operational than a full patch-and-update program covering all software. Regularly scanning for new files is a detective control that may miss zero-day, polymorphic, or obfuscated malware and does not prevent the initial execution. None of these options addresses the exploitation of unpatched vulnerabilities as directly as D.Community Comment Notes
insaniunt argued that "Applying the latest patches and updating software programs is essential" and tied it to protection from known vulnerabilities. LordXander added that "is D based on CEHv12 1187", indicating the source question maps to answer D in the CEH v12 bank. Other learners simply asked for confirmation, so the comment thread shows consensus but little independent debate. The community evidence aligns with the technical analysis above.Official Reference
Exam Strategy
When a CEH question asks for the most effective prevention, separate preventive controls from detective controls. Pick the answer that removes the vulnerability or blocks the attack path, not one that only finds files after execution.
Frequently Asked Questions
Why isn't regularly scanning for new files the best prevention for email malware?
Scanning is mainly detective and occurs after the attachment lands or runs, so it may miss zero-day or obfuscated malware. Patching closes the vulnerabilities that let the payload execute.
Does disabling Autorun stop malware delivered in an email attachment?
No. Autorun settings control removable drives and optical media; they do not stop a user from opening an email attachment or a document that exploits an unpatched application.