Question 1

Which two action types are performed by Cisco ESA message filters? (Choose two.)

Accepted Answer

Explanation: Non-final actions are actions that do not terminate the message filter evaluation, such as adding headers, setting variables, logging, etc. Final actions are actions that end the message filter evaluation and determine the fate of the message, such as accept, drop, bounce, quarantine, etc. Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 3-4. Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/ b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.html

Question 2

An organization wants to designate help desk personnel to assist with tickets that request the release
of messages from the spam quarantine because company policy does not permit direct end-user
access to the quarantine. Which two roles must be used to allow help desk personnel to release
messages while restricting their access to make configuration changes in the Cisco Secure Email
Gateway? (Choose two.)

Accepted Answer

B, E

Explanation: All users with administrator privileges can change spam quarantine settings and view and manage messages in the spam quarantine. You do not need to configure spam quarantine access for administrator users. If you configure access to the spam quarantine for users with the following roles, they can view, release, and delete messages in the spam quarantine: -Operator -Read-only operator -Help desk user -Guest -Custom user roles that have spam quarantine privileges These users cannot access spam quarantine settings. https://www.cisco.com/c/en/us/td/docs/security/esa/esa140/user_guide/b_ESA_Admin_Guide_14- 0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

Question 3

Which two are configured in the DMARC verification profile? (Choose two.)

Accepted Answer

Explanation: A DMARC verification profile is a list of parameters that the mail flow policies of the appliance use for verifying DMARC. The name of the verification profile identifies the profile and allows you to apply it to different mail flow policies. The message action to take when the policy is reject/quarantine determines how the appliance handles messages that fail DMARC verification based on the sender’s DMARC policy. Reference: User Guide for AsyncOS 12.0 for Cisco Email Security Appliances - GD (General Deployment), Chapter: Email Authentication, Section: Configuring DMARC Verification Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/ b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_010101.html#task_1231917

Question 4

Which global setting is configured under Cisco ESA Scan Behavior?

Accepted Answer

C

Explanation: The global setting that is configured under Cisco ESA Scan Behavior is the actions for unscannable messages due to attachment type. This setting allows the administrator to specify what action to take when a message contains an attachment that cannot be scanned by the appliance, such as encrypted or password-protected files. The possible actions are: Deliver - Deliver the message normally. Drop - Drop the message silently without notifying the sender or recipient. Quarantine - Quarantine the message in a specified policy quarantine. Bounce - Bounce the message back to the sender with a specified reason. Reference: Scan Behavior Reference: https://community.cisco.com/t5/email-security/cisco-ironport-esa-security-services-scanbehavior- impact-on-av/td-p/3923243

Question 5

Which benefit does enabling external spam quarantine on Cisco SMA provide?

Accepted Answer

D

Explanation: External spam quarantine is a feature that allows Cisco SMA to store and manage spam messages quarantined by multiple Cisco ESAs in one central location, providing a unified view and administration of the spam quarantine data. Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-3. Reference: https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma110/user_guide/ b_SMA_Admin_Guide/b_SMA_Admin_Guide_chapter_010101.html

Question 6

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/300-720/page_37_img_1.jpg Refer to the exhibit. An engineer is trying to connect to a Cisco ESA using SSH and has been unsuccessful. Upon further inspection, the engineer notices that there is a loss of connectivity to the neighboring switch. Which connection method should be used to determine the configuration issue?

Accepted Answer

D

Explanation: Serial connection is a method that should be used to determine the configuration issue when there is a loss of connectivity to the neighboring switch. Serial connection allows the engineer to access the Cisco ESA console port using a serial cable and a terminal emulator, such as PuTTY or HyperTerminal, without relying on the network connectivity. The other options are not valid methods to determine the configuration issue when there is a loss of connectivity to the neighboring switch, because they require network connectivity to work. Reference: Cisco Email Security Appliance C690 Quickstart Guide, page 2.

Question 7

An administrator is managing multiple Cisco ESA devices and wants to view the quarantine emails from all devices in a central location. How is this accomplished?

Accepted Answer

C

Explanation: Disabling the Local Spam Quarantine to Activate the External Quarantine If you were using a local spam quarantine before enabling an external spam quarantine, you must disable the local quarantine in order to send messages to the external quarantine. https://www.cisco.com/c/en/us/td/docs/security/esa/esa111/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101010.html?bookSearc h=true#con_1172419

Question 8

Which two certificate authority lists are available in Cisco ESA? (Choose two.)

Accepted Answer

Explanation: System: This is the default list of trusted certificate authorities that is provided by Cisco and updated automatically. It contains the certificates of well-known and widely used certificate authorities, such as VeriSign, Thawte, and GoDaddy. Custom: This is the list of additional certificate authorities that you can add manually or import from a file. It allows you to trust certificates that are issued by your own or third-party certificate authorities that are not included in the system list. Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/ b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_11_1_chapter_011000.html#task_1194859

Question 9

Which two factors must be considered when message filter processing is configured? (Choose two.)

Accepted Answer

Explanation: Message-filter order and MIME structure of the message are two factors that must be considered when message filter processing is configured on Cisco ESA. Message-filter order determines the sequence in which message filters are evaluated and applied to incoming messages, which can affect the final outcome of the filtering process. MIME structure of the message determines how message filters match against different parts of the message, such as headers, body, attachments, etc., which can affect the accuracy and performance of the filtering process. Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 3-3 and page 3-5. Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/ b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01000.html

Question 10

Which two Cisco ESA features are used to control email delivery based on the sender? (Choose two.)

Accepted Answer

Explanation: Safelists and blocklists are features on Cisco ESA that allow you to control email delivery based on the sender. Safelists are lists of sender addresses or domains that you want to accept or exempt from certain filtering actions. Blocklists are lists of sender addresses or domains that you want to reject or drop3. Reference = Securing Email with Cisco Email Security Appliance (SESA) v3.1

Question 11

A network engineer must tighten up the SPAM control policy of an organization due to a recent SPAM attack. In which scenario does enabling regional scanning improve security for this organization?

Accepted Answer

D

Explanation: Enabling regional scanning improves security for this organization when most of the received email originates from a specific region. Regional scanning is a feature that allows Cisco ESA to apply different spam thresholds and actions based on the geographic region of the sender’s IP address, using a database of IP addresses and regions. To enable regional scanning on Cisco ESA, the administrator can follow these steps: Select Security Services > IronPort Anti-Spam and click Edit Settings. Under Regional Scanning, select Enable Regional Scanning. Click Submit. Select Security Services > IronPort Anti-Spam > Regional Settings and click Add Region. Choose a region from the drop-down menu, such as Asia Pacific. Enter a spam threshold and an action for that region, such as 80 and Drop. Click Submit.

Question 12

An engineer is configuring an SMTP authentication profile on a Cisco ESA which requires certificate verification. Which section must be configured to accomplish this goal?

Accepted Answer

A

Explanation: :

Question 13

Which two query types are available when an LDAP profile is configured? (Choose two.)

Accepted Answer

Explanation: User and routing are two query types that are available when an LDAP profile is configured on Cisco ESA. User queries are used to validate end-user credentials, such as for Spam Quarantine End-User Authentication or SMTP Authentication. Routing queries are used to determine the destination mail server for a recipient, such as for Mail Flow Policies or Delivery Methods. Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-7.

Question 14

An engineer is configuring a Cisco ESA for the first time and needs to ensure that any email traffic
coming from the internal SMTP servers is relayed out through the Cisco ESA and is tied to the
Outgoing Mail Policies.
Which Mail Flow Policy setting should be modified to accomplish this goal?

Accepted Answer

B

Explanation: Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118136qanda-esa-00.html Connection Behavior setting allows you to specify how the Cisco Email Security Appliance (ESA) handles incoming connections from different sender groups. You can choose from four different settings: Accept: The ESA accepts all connections from the sender group and applies the mail flow policy settings to the messages. Throttle: The ESA limits the number of concurrent connections and messages per connection from the sender group. This can help reduce the impact of spam or malicious traffic on the ESA’s performance. Reject: The ESA rejects all connections from the sender group and returns a 5xx SMTP error code to the sender. This can help block unwanted or abusive senders from reaching your network. Test: The ESA accepts connections from the sender group but does not deliver the messages to the recipients. Instead, it logs the messages and marks them as test messages. This can help you test the mail flow policy settings before applying them to real traffic. To modify the Connection Behavior setting for a sender group, you need to do the following steps: On the ESA, choose Mail Policies > HAT Overview. Click Edit Settings for the sender group that you want to modify. In the Mail Flow Policy Settings section, choose one of the options from the Connection Behavior drop-down list. Click Submit and commit changes.

Question 15

An engineer is tasked with reviewing mail logs to confirm that messages sent from domain abc.com are passing SPF verification and being accepted by the Cisco ES

Accepted Answer

B

Explanation: SPF verification is a feature that allows Cisco ESA to verify the authenticity of the sender’s domain by checking the sender’s IP address against a DNS record published by the domain owner. An SPF record is a TXT record that specifies the authorized IP addresses or hosts for sending emails from a domain, using a syntax of qualifiers, mechanisms, and modifiers. The reason why the verification is not working properly is that SPF verification is disabled on the mail flow policy that applies to the messages sent from domain abc.com. A mail flow policy is a set of rules that determine how incoming or outgoing messages are processed by Cisco ESA, including whether to enable SPF verification or not. To enable SPF verification on the mail flow policy, the administrator can follow these steps: Select Mail Policies > Mail Flow Policies and click Edit Settings for the mail flow policy that applies to the messages sent from domain abc.com. Under Sender Authentication, select Enable SPF Verification and choose an SPF conformance level from the drop-down menu. Click Submit. The other options are not valid reasons why the verification is not working properly, because they do not affect SPF verification on the mail flow policy.

Free Cisco 300-720 SESA Actual Exam Questions