A security architect wants to prevent employees from receiving malicious attachments by email. Which of the following functions should the chosen solution do?

Scanning email traffic inline is the most effective solution because it actively inspects email content, including attachments, as it flows through the network. This allows the system to detect and block malicious attachments before they reach employee inboxes. Applying IP address reputation data helps identify known malicious senders but won't catch new threats or compromised legitimate senders. Tapping and monitoring the email feed is a passive observation technique, useful for forensics or auditing, but it doesn't prevent delivery. Checking SPF records verifies the sender's legitimacy but doesn't analyze attachment content for malware.