You are the messaging engineer for your company. Your company has an Exchange Server 2007 messaging system.
The perimeter network contains an Edge Transport server. The Edge Transport server has content filtering enabled.
You need to recommend additional anti-spam configurations that meet the following requirements:
Reject connections from Internet addresses that are from known sources of spam.
Maintain the Internet addresses that are from known sources of spam by using an external service.
Reject e-mail from Internet addresses that are possible sources of spam by running SMTP open proxy tests.
Which two configurations should you recommend? (Each correct answer presents part of the solution.
Choose two.)
A.
Enable sender filtering.
B.
Enable sender reputation.
C.
Enable an IP Block List provider.
D.
Configure Sender ID to stamp the message with the Sender ID result.
E.
Configure recipient filtering to reject recipients that are not in the global address list.
Explanation:
EMC > Organization Configuration > Edge or Hub Transport > Anti-Spam > Sender Reputation & IP Block List Providers…The Sender Reputation tool scrutinizes a variety of source and message characteristics:
1. HELO/EHLO analysis: These SMTP commands provide the receiving server with domain name or IP address information about the email source. Spammers often forge the HELO/EHLO statement.
2. Reverse DNS lookup: Does the IP address the message was transmitted from match the registered domain name submitted in the HELO or EHLO command? If not, the sender is likely a spammer.
3. SCL ratings on previously received email from the same source.
4. Open proxy test: An open proxy is a proxy server accepting connection requests from anyone, anywhere, then, forwarding this traffic as if originated on this local host. Open proxies can result from either unintentional misconfiguration or Trojan Horse infection.
Weighing such statistics, a Sender Reputation Level is calculated for each email source. This is a number, ranging from zero to nine, to predict the chance the sender is a spammer. A value of zero indicates the source is clean, while a value of nine, its probably a spammer. By default, a rating of zero is assigned to any fresh, unanalyzed source; after 20 or more messages are received, the SRL for the sender is determined.
You can set a block threshold, a number between zero and nine, at which sender reputation requests the Sender Filter agent to block mail from a particular source entering the organization. When any source is blocked this way, its added to the Blocked Senders list for a prescribed period of time. Sender Filter agent configuration determines how these blocked messages are handled.
http://technet.microsoft.com/en-us/library/bb124512.aspx
IP Block List and IP Allow List provider services help reduce spam and enhance overall message processing. Multiple provider services can be engaged. A priority rating can be set for each such service to determine the order in which theyre queried. When an IP Block list match is received, the Connection Filter Agent stops further querying of other services. For each provider service, you can customize the SMTP 550 error message returned to the blocked email source.
http://technet.microsoft.com/en-us/library/bb124369.aspx