LPIC-2 System Security Practice Question
An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?
⚠ Common exam trap
Many exam-takers confuse SMTPS (port 465) with STARTTLS, believing that using a dedicated SSL port is more secure, when in fact STARTTLS is the modern, standardized approach that allows encryption on standard ports and is required for compliance with many security frameworks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable STARTTLS on the SMTP server to encrypt connections.
STARTTLS is the standard method for upgrading a plaintext SMTP connection to an encrypted one using TLS, as defined in RFC 3207. It allows the mail server to negotiate encryption on the standard SMTP port (25) or submission port (587), ensuring that email traffic is encrypted in transit without requiring a separate port or protocol. This is the most appropriate solution because it is widely supported, interoperable, and aligns with modern email security best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement IPsec to encrypt all traffic between mail servers.
Why it's wrong here
IPsec encrypts traffic at the network layer, but the requirement is specifically for email traffic between mail servers, which operates at the application layer using SMTP. IPsec cannot selectively encrypt only email data without also encrypting all other IP traffic between the hosts, making it an overbroad solution. It is tempting because IPsec does provide strong encryption for data in transit, and it would be correct for a scenario requiring a VPN tunnel to secure all communication between two network segments.
- ✗
Use SMTPS (SMTP over SSL) on port 465.
Why it's wrong here
SMTPS is deprecated; STARTTLS is the standard.
- ✗
Configure the mail server to use SSH tunneling for all SMTP connections.
Why it's wrong here
SSH tunneling is not standard for email transport.
- ✓
Enable STARTTLS on the SMTP server to encrypt connections.
Why this is correct
STARTTLS upgrades plain SMTP to encrypted using TLS.
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.