Exam CAS-004 All QuestionsBrowse all questions from this exam
Go to Exam
Question 17

A security engineer has been asked to close all non-secure connections from the corporate network. The engineer is attempting to understand why the corporate

UTM will not allow users to download email via IMAPS. The engineer formulates a theory and begins testing by creating the firewall ID 58, and users are able to download emails correctly by using IMAP instead. The network comprises three VLANs:

The security engineer looks at the UTM firewall rules and finds the following:

Which of the following should the security engineer do to ensure IMAPS functions properly on the corporate user network?

    Correct Answer: C

    To ensure IMAPS functions properly on the corporate user network, it is crucial that the UTM certificate is imported on the corporate computers. This ensures that TLS decryption, which the UTM is configured to perform, can function correctly. Without the UTM's certificate, the secure connections (like those over port 993 for IMAPS) will not be trusted by the client computers, causing the connection to fail.

Discussion
BoatsOption: B

So we know IMAP rule works on port 143 with rule 58. Then we know then that A. and C. don't apply. The IP is not being blocked. Also a UTM certificate does not apply to this question. So that leaves B and D. We would need a certificate for IMAPS on port 993 but we also need a firewall rule for 993. Is rule 19 with destination to Any good enough or do we need to specify the IP, 15.22.33.45? If the rule is good enough then we don't need to create another rule and that means that the email server needs a certificate for TLS/SSl so it can use IMAPS/TCP 993. Therefore the answer has to be B.

BinaryGuardian42

I do not agree with your assessment. Rule 58 works because it now allows IMAP on port 143, which is not encrypted. The UTM does not need to decrypt, thus certificate of UTM is not used. Correct answer is C.

thenetOption: C

TLS decryption enabled, client need to have UTM certificate

kimssster

for rule 19 port for imaps is used 993. Also decryption is enabled. So clients need UTM cert installed.

ElDirecOption: C

The question is formulated based on the fact that rule 19 is already in place to allow for IMAPS/993. The answer cannot be create a rule. Because of the UTM, and the SSL inspection, you will need a certificate installed on each client (corporate computers). So the answer is C. Make sure the UTM certificate is imported on the corporate computers.

BiteSizeOption: B

Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

saucehozz

Well you and your LLM are incorrect.

GeofabOption: B

I agree with B as well

cyspecOption: C

IMAPS uses port 993, which is on the last line. TLS decryption is enabled, meaning that the UTM is decrypting TLS traffic. The UTM is in-between the email server and the client. Let's look at why the other options are invalid. A: Users were able to download emails via IMAP, ruling this out. B: Line 1 reveals that the mail server is out on the Internet. The email server would have a public certificate signed by a trusted CA. There is no need to add the email server's certificate to the client computer's trusted root store. D: The last line exists and it is marked as active.

saucehozzOption: C

C) The UTM is doing break and inspect of IMAPS (TLS) traffic, therefore the UTMs certificate is required on the corporate users computers.

ayeayeronpaulOption: D

I'm inclined to go with D. I may be reading into the question a little too hard, but the question is prefaced with "The engineer formulates a theory and begins testing by creating the Firewall ID 58, and users are able to download emails correctly by using IMAP instead". Since that action was successful, wouldn't it make sense for the engineer to continue troubleshooting the firewall rules rather than moving on to troubleshooting certificates? CompTIA harps on their troubleshooting methodology and the engineer was at step 3, Test the theory to determine the cause. It seems likely that the engineer determined the cause was firewall rules when he created Rule 58 and IMAP worked. Wouldn't next best step be to see if creating an explicit rule specifying a destination of 15.22.33.45 would fix IMAPS despite the catch-all Rule 19? Then if that still doesn't fix things, move away from the networking layer and start troubleshooting certificates?

SepuOption: C

TLS Decryption is enabled for port 993, so clients need the UTM certificate.

lifeblood12005Option: C

The correct answer is: Make sure the UTM certificate is imported on the corporate computers.

MookieLoLoOption: D

The answer is D. The port number for IMAPS is 993 (not 990). The wrong port number was used for the Firewall rule. (FTPS port 990). When the new rule allowed the email to be passed with ID 58... It used IMAP (port 143). That debunked an issue with the certificate.

nihei

Incorrect. The 990 rule you're looking at is disabled and isn't relevant. The email being allowed with IMAP 143 doesn't disprove a certificate issue because it isn't secure and wouldn't use a certificate anyway. It's B.

23169fdOption: B

Given that the firewall rule (ID 19) already permits IMAPS traffic, the best action to ensure IMAPS functions properly is to confirm that the email server certificate is installed on the corporate computers. This will ensure that the clients can establish a secure connection using IMAPS

23169fd

Certificate Importance: For IMAPS to function correctly, the email clients on the corporate computers must trust the email server's certificate. If the certificate is not installed or trusted, secure connections will fail. TLS/SSL Requirements: IMAPS (port 993) relies on TLS/SSL, which requires a valid and trusted certificate for the connection to be established successfully.

holymollyOption: B

Correct option is B Contact me at <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="2d4042414154034a4c5f5948436d42585941424246034e4240">[email protected]</a> to get all questions

thattanguyzOption: D

IMAPS (Internet Message Access Protocol Secure) is a protocol that allows users to access and manipulate email messages on a remote mail server over a secure connection. IMAPS uses SSL/TLS encryption to protect the communication between the client and the server. IMAPS uses port 993 by default. To ensure IMAPS functions properly on the corporate user network, the security engineer should create an IMAPS firewall rule on the UTM (Unified Threat Management) device that allows traffic from VLAN 10 (Corporate Users) to VLAN 20 (Email Server) over port 993. The existing firewall rules do not allow this traffic, as they only allow HTTP (port 80), HTTPS (port 443), and SMTP (port 25). Reference: https://www.techopedia.com/definition/2460/internet-message-access-protocol-secure-imaps https://www.sophos.com/en-us/support/knowledgebase/115145.aspx

Delab202Option: D

Based on the provided information, the security engineer should: D. Create an IMAPS firewall rule to ensure email is allowed. Explanation: The existing firewall rules are allowing traffic on ports 143, 80, 443, 990, 993, and 587, but there is no specific rule for IMAPS (port 993) on the corporate user network (VLAN 20). Rule 19 allows traffic on ports 993 and 587 from VLAN 20 to any destination and logs the traffic. However, Rule 21, which is intended for IMAPS (port 990) from VLAN 20 to a specific destination (15.22.33.45), is not active (No). To ensure IMAPS functions properly on the corporate user network (VLAN 20), the security engineer should create a specific IMAPS firewall rule that allows traffic on port 993 from VLAN 20 to the appropriate destination.

catastrophieOption: B

I'm going to say B on this one. Not quite as confident as some of the other questions but here are my thoughts. A certificate is needed (or at least most of the time, depending on your configuration and needs) client side if the TLS decryption is happening at the application layer. This scenario is all networking layer dealing with VLANS, IPs, Ports and ACL's; therefore, a client-side certificate is not required to perform TLS decryption at the network edge like this. I'm going with B on this one.

kosioOption: D

And what about the firewall rule which is with state Disabled. This should be enabled in order to clients to get in touch with the server, then comes the cert checks, etc. The first issue for me is that the rule is not active. Answer D looks better for this situation, but the wording of this answer is misleading as we don't need another rule, but just to enable current one...

DaleC78

What specific rule do you mean? All rules that provide IMAP / IMAPS access are already enabled, so no FW issue here. The problem is that clients don't have the right certificate installed to download email via IMAPS