Enhancing Enterprise Capabilities
Given a scenario, modify enterprise capabilities to enhance security
What you will learn
- Know what each security appliance does and when it is the answer.
- Explain the email trio SPF, DKIM and DMARC and how they work together.
- Separate endpoint protection from network protection, and EDR from XDR.
- Understand network access control's role before a device is given a connection.
This objective is a list of tools, and its question is always: which tool addresses this description? The key is knowing where each one sits — on the network, on the host, in name resolution, or in the mail path — because the description implies the location.
On the network
| Firewall rules | Rules evaluated in order, ending in an implicit deny. Order changes the outcome. |
|---|---|
| WAF | A web application firewall: it understands HTTP and blocks injection and cross-site scripting. An ordinary firewall does not see them. |
| NGFW / UTM | A firewall inspecting application, identity and content rather than ports alone. |
| DNS filtering | Blocking resolution of malicious names. It stops the connection before it starts, whatever port is used. |
| NAC | Network access control: a device gets no connection until its identity and posture are checked — patched? antivirus running? |
On the host and in the data
| EDR | Endpoint detection and response: watches behaviour on the host and can isolate it remotely. |
|---|---|
| XDR | Extending EDR across network, email and cloud into one correlated view. |
| DLP | Stops classified data leaving by email, web or removable media. |
| FIM | File integrity monitoring: alerts when critical system files are modified. |
| UBA | User behaviour analytics: compares an account's activity with its own norm — a large nightly download from an account that never does that. |
The email security trio
SPF says who may send
A record declaring which servers may send on your domain's behalf.
DKIM signs the message
A digital signature proving the message was not altered and came from your domain — a direct link to objective 1.4.
DMARC says what to do with failures
A policy: accept, quarantine, or reject — with reporting. Without it the first two have no practical effect.
Which tool for which description
"SQL injection on our site" = WAF, not an ordinary firewall. "An unpatched device joined the network" = NAC. "A card number left in an email" = DLP. "A strange process on an employee's laptop" = EDR. "Messages spoofing our domain" = SPF, DKIM and DMARC. Read where the event happened and you have the tool.
Real-world example: a spoofed domain
Messages reach the company's customers that appear to come from its domain, asking them to update bank details. The company was not breached — the attacker is only spoofing the domain, which is possible because email inherently does not verify the sender. The fix is a trio: SPF declares the authorised servers, DKIM signs every outbound message, and DMARC tells receiving servers to reject what fails both. Publishing the first two alone is common and has no effect: the receiving server sees the failure and does not know what to do with it until a DMARC policy tells it.
What matters on the exam
- An ordinary firewall sees ports; a WAF sees HTTP content. Web attacks need the second.
- DMARC is what makes SPF and DKIM effective. Any answer naming the two without the third is incomplete.
- NAC acts before network access is granted; EDR acts once the device is already inside. Timing separates them.
- DNS filtering stops the connection before it begins and works whatever port changes — a common answer for blocking command and control.
Quick check
Answer in your head first, then reveal.
What does DMARC add if SPF and DKIM are already published?Reveal the answer
It tells the receiving server what to do with a message that fails them: accept, quarantine or reject — and it sends reports. Without it the receiver detects the failure and does nothing.
An unpatched visitor device is plugged into a meeting-room network port. Which tool stops it?Reveal the answer
Network access control: it checks the device's identity and posture before granting a connection, and either quarantines it or refuses it if it does not meet the requirements.
What separates EDR from XDR?Reveal the answer
Scope. EDR sees the endpoint alone; XDR correlates endpoint with network, email and cloud into one view — surfacing what no single source shows.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.