Implementing and Operating Cisco Security Core Technologies (SCOR)654 questions across 66 pages are complete and free, with no account or card.
654 questions in this bank
Free access · progress saved on this device
What is the purpose of the Decrypt for Application Detection feature within the WSA Decryption options?
Answer: D
Reference: https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-7/user_guide/b_WSA_UserGuide_11_7/b_WSA_UserGuide_11_7_chapter_01011.html
Source: Adapted from community discussion — ddev3737
A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?
Answer: B
I'm not really sure about the answer, but it could be B "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.' https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
Source: Adapted from community discussion — Seawanderer
An engineer is configuring a Cisco ESA and wants to control whether to accept or reject email messages to a recipient address. Which list contains the allowed recipient addresses?
Answer: D
The correct answer is D. RAT (Recipient Access Table). The Cisco ESA (Email Security Appliance) can be used to control whether to accept or reject email messages to a recipient address. The list that contains the allowed recipient addresses is called the Recipient Access Table (RAT). The Recipient Access Table (RAT) is a list of email addresses that have been authorized to receive emails. When an email is received, the Cisco ESA checks the email address against the list in the RAT to determine whether to accept or reject the email.
Source: Adapted from community discussion — sull3y
Why would a user choose an on-premises ESA versus the CES solution?
Answer: A
Which two features are used to configure Cisco ESA with a multilayer approach to fight viruses and malware? (Choose two.)
Answer: AD
D for sure Cisco ESA uses a multilayer approach to fight viruses and malware: • The first layer of defense consists of outbreak filters, which the appliance downloads from Cisco SenderBase. They contain a list of known bad mail servers. These filters are generated by watching global email traffic patterns and looking for anomalies associated with an outbreak. When an email is received from a server on this list, it is kept in quarantine until the antivirus signatures are updated to counter the current threat. • The second layer of defense is using antivirus signatures to scan quarantined emails, to ensure that they do not carry viruses into the network. • Cisco ESA also scans outbound emails to provide antivirus protection.
Source: Adapted from community discussion — jshow
After a recent breach, an organization determined that phishing was used to gain initial access to the network before regaining persistence. The information gained from the phishing attack was a result of users visiting known malicious websites. What must be done in order to prevent this from happening in the future?
Answer: A
The Web Security appliance intercepts requests that are forwarded to it by clients or other devices over the network. The appliance works in conjunction with other network devices to intercept traffic. These may be ordinary switches, transparent redirection devices network taps,and other proxy servers or Web Security appliances.
Source: Adapted from community discussion — Iarn
An engineer has enabled LDAP accept queries on a listener. Malicious actors must be prevented from quickly identifying all valid recipients. What must be done on the Cisco ESA to accomplish this goal?
Answer: A
To prevent malicious actors from quickly identifying all valid recipients, the engineer can use Directory Harvest Attack Prevention (DHAP) on the Cisco ESA. DHAP blocks SMTP messages to invalid recipient addresses and limits the number of messages that can be sent to the server, which helps prevent attackers from obtaining a complete list of valid email addresses. Therefore, option A is the correct answer. Option B, bypassing LDAP access queries in the recipient access table, does not provide any protection against Directory Harvest Attacks (DHAs). Option C, using Bounce Verification, is used to prevent backscatter, which is when an email system sends a bounce message to an innocent victim, who did not send the original message and who is not the intended recipient of the bounce message. Option D, configuring incoming content filters, is used to block unwanted emails based on message content.
Source: Adapted from community discussion — yong08321
In which two ways does a system administrator send web traffic transparently to the Cisco WSA? (Choose two.)
Answer: AD
When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policy-based routing (PBR)—available on many routers —or using Cisco’s Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches. Extract from Cisco OCG
Source: Adapted from community discussion — getafix
What is the function of the Context Directory Agent?
Answer: A
Cisco Context Directory Agent (CDA) is a mechanism that maps IP Addresses to usernames in order to allow security gateways to understand which user is using which IP Address in the network, so those security gateways can now make decisions based on those users (or the groups to which the users belong to).
Source: Adapted from community discussion — mecacig953
A network administrator is configuring a rule in an access control policy to block certain URLs and selects the `Chat and Instant Messaging` category. Which reputation score should be selected to accomplish this goal?
Answer: D
The answer is D. 1. A reputation score of 1 is the lowest possible score, and it indicates that the URL is considered to be very risky. This means that the network administrator should block all URLs with a reputation score of 1, in order to prevent users from accessing malicious websites. The other possible answers are incorrect. A reputation score of 5 is considered to be "neutral", while a reputation score of 10 is considered to be "good". This means that URLs with these scores should not be blocked. A reputation score of 3 is considered to be "suspect", and it may be necessary to block some URLs with this score, depending on the organization's specific policies and risk tolerance. Here is a table that shows the different reputation scores and their corresponding meanings: Reputation Score | Meaning ------- | -------- 1 | Very risky 3 | Suspect 5 | Neutral 10 | Good
Source: Adapted from community discussion — Kuzi
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
350-701 practice, question 111. 654 questions available.
Version 1.0.0. How we source questions