How to Prevent Malicious Email Attachments?

SY0-701 By islever Editorial Last updated Sep 1, 2026

Short answer

C Scan email traffic inline.

Question

A security architect wants to prevent employees from receiving malicious attachments by email. Which of the following functions should the chosen solution do?

Apply IP address reputation data.
Tap and monitor the email feed.
Scan email traffic inline. Correct Answer
Check SPF records.

Key Takeaways

This question tests the distinction between content analysis and sender verification, with the common trap being selecting SPF records which do not scan for malware.

To effectively prevent malicious attachments, security solutions must scan email traffic inline. The community consensus confirms that inline scanning is required to analyze and block malicious content before it reaches the user.

Common mistake: Choosing 'Check SPF records' (Option D) is the most frequent error because SPF verifies the sender's identity but does not inspect email attachments for malicious code.

Expert Analysis

Why the Answer Is Correct

Inline scanning (Option C) analyzes email content and attachments in real-time as they pass through the mail gateway. This method allows the security system to identify and quarantine malicious files before they are delivered to the end user. It is the only option listed that directly addresses the inspection of the attachment payload.

Why the Other Options Are Wrong

IP reputation (Option A) blocks connections from known malicious sources but does not analyze the specific content of emails. Tapping the feed (Option B) implies passive monitoring and copying of traffic, which does not actively prevent delivery. Checking SPF records (Option D) validates that the email comes from an authorized server to prevent spoofing, but it offers no visibility into the safety of the attachment itself.

Community Comment Notes

Community members strongly support Option C, emphasizing that SPF is strictly for sender verification and cannot detect malicious payloads. Several comments highlight that while SPF improves deliverability and stops spoofing, it is blind to the message content, making inline scanning the necessary choice for malware prevention.

Official Reference

https://csrc.nist.gov/pubs/sp/800/45/rev/2/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When facing email security questions, determine if the issue relates to the source of the email or the content within it. If the threat involves malware or attachments, look for scanning or filtering solutions; if the threat involves spoofing, choose authentication protocols like SPF.

Community Votes

69%

31%

69% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Cocopqr 👍 7 Answered C

C. Scan email traffic inline. Inline scanning is the most effective method to prevent malicious attachments from reaching employees' inboxes. By scanning emails in real-time, as they are being delivered, the security solution can identify and block malicious attachments before they reach the user's device. SPF records are used to verify the sender's identity, but they do not prevent malicious attachments
e2ba0ff 👍 4 Answered D

spf : Sender Policy Framework Preventing email spoofing Improving email deliverability
jbmac 👍 1 Answered C

The correct answer is: C. Scan email traffic inline. Explanation: To prevent employees from receiving malicious attachments via email, the solution should scan email traffic inline. This involves scanning email messages, including attachments, as they pass through the mail server. By scanning emails inline, the system can identify and block malicious attachments before they are delivered to the user's inbox. This type of solution often includes antivirus and anti-malware scanning for email content.
9149f41 👍 1 Answered C

Only scanning the inbox can detect and protect the malicious attachment. Detect Malicious Attachments: SPF (Sender Policy Framework) does not scan or analyze the content of emails, including attachments. Block Phishing or Malware: SPF only verifies the sender's server, not the safety of the email's content.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide