300-720 practice questions 111–120

1. Question 111 · 149 in bank

   A Cisco ESA administrator is creating a Mail Flow Policy to receive outbound email from Microsoft Exchange. Which Connection Behavior must be selected to properly process the messages?

   • ADelay
   • BAccept
   • CRelay
   • DReject

   Show answer

   Answer: C

   Explanation

   Correct. Default HAT Entries By default, the HAT is defined to take different actions depending on the listener type: Public listeners. The HAT is set to accept email from all hosts. Private listeners. The HAT is set up to relay email from the host(s) you specify, and reject all other hosts. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0110.html?bookSearch=true

   Source: Adapted from community discussion — GVKD

   References

   • Cisco documentation

   Next question

2. Question 112 · 149 in bank

   An administrator needs to configure a Cisco ESA to block specific domains based on their reputation. Which service within the Cisco ESA should be utilized to accomplish this task?

   • AReceiving SMTP Policy
   • BData Loss Prevention
   • CAnti-Virus
   • DSender Group

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

3. Question 113 · 149 in bank

   An administrator notices that the Cisco ESA delivery queue is consistently full. After further investigation, it is determined that the IP addresses currently in use by the Cisco ESA are being rate-limited by some destinations. The administrator creates a new interface with an additional IP address using virtual gateway technology, but the issue is not solved. Which configuration change resolves the issue?

   • AUse the CLI command alt-src-host to set the new interface as a possible delivery candidate.
   • BUse the CLI command loadbalance auto to enable mail delivery over all interfaces.
   • CUse the CLI command deliveryconfig to set the new interface as the primary interface for mail delivery.
   • DUse the CLI command altsrchost to set the new interface as the source IP address for all mail.

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

4. Question 114 · 149 in bank

   Select 2

   An engineer tries to implement phishing simulations to test end users, but they are being blocked by the Cisco ESA. Which two components, when added to the allow list, allow these simulations to bypass antispam scanning? (Choose two.)

   • Areceivers
   • Bdomains
   • Creputation score
   • Dspf check
   • Esenders

   Show answer

   Answer: BE

   Next question

5. Question 115 · 149 in bank

   What is a benefit of deploying Cisco SMA?

   • Acentralized management of logs for Cisco ESA appliances
   • Bcentralized management of botnet directories
   • Ccentralized management of software updates for Cisco ESA appliances
   • Dcentralized management of quarantined email

   Show answer

   Answer: D

   Explanation

   D is Correct. The Security Management appliance includes the following features: -External spam quarantine. Holds spam and suspected spam messages for end users, and allow end users and administrators to review messages that are flagged as spam before making a final determination. -Centralized policy, virus, and outbreak quarantines. Provide a single location behind the firewall to store and manage messages quarantined by anti-virus scanning, outbreak filters, and policies. -Centralized reporting. Run reports on aggregated data from multiple Email Security appliances. -Centralized tracking. Track email messages that traverse multiple Email Security appliances. For complete information about configuring and using your Cisco Content Security Management appliance, see the Cisco Content Security Management Appliance User Guide https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101010.html?bookSearch=true

   Source: Adapted from community discussion — GVKD

   References

   • Cisco documentation

   Next question

6. Question 116 · 149 in bank

   A Cisco ESA administrator was notified that a user was not receiving emails from a specific domain. After reviewing the mail logs, the sender had a negative sender-based reputation score. What should the administrator do to allow inbound email from that specific domain?

   • ACreate a new inbound mail policy with a message filter that overrides Talos.
   • BAsk the user to add the sender to the email application’s allow list.
   • CModify the firewall to allow emails from the domain.
   • DAdd the domain into the allow list.

   Show answer

   Answer: D

   Next question

7. Question 117 · 149 in bank

   Select 2

   An email containing a URL passes through the Cisco ESA that has content filtering disabled for all mail policies. The sender is sampleuser@test1.com, the recipients are testuser1@test2.com, testuser2@test2.com, testuser3@test2.com, and mailer1@test2.com. The subject of the email is Test Document395898847. An administrator wants to add a policy to ensure that the Cisco ESA evaluates the web reputation score before permitting this email. Which two criteria must be used by the administrator to achieve this? (Choose two.)

   • ASubject contains “TestDocument”
   • BSender matches test1.com
   • CEmail body contains a URL
   • DDate and time of email
   • EEmail does not match mailer1@test2.com

   Show answer

   Answer: BC

   Explanation

   B and C are Correct. To ensure that the Cisco ESA evaluates the web reputation score before permitting the email described in the scenario, the administrator should use the following two criteria: B. Sender matches test1.com: By matching the sender's domain (test1.com), the administrator can identify emails originating from that specific domain for further evaluation, including web reputation scoring. C. Email body contains a URL: By checking if the email body contains a URL, the administrator can identify emails that include web links and evaluate their reputation before permitting them. This ensures that the web reputation score is considered for emails containing URLs. By utilizing these two criteria, the administrator can enforce a policy that evaluates the web reputation score before permitting the email to be delivered.

   Source: Adapted from community discussion — GVKD

   Next question

8. Question 118 · 149 in bank

   Which feature must be enabled first when URL logging is configured on a Cisco ESA?

   • Aantivirus
   • Bantispam
   • Csenderbase reputation filter
   • Dvirus outbreak filter

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

9. Question 119 · 149 in bank

   A recent engine update was pulled down for graymail and has caused the service to start crashing. It is critical to fix this as quickly as possible. What must be done to address this issue?

   • ARoll back to a previous version of the engine from the Services Overview page.
   • BRoll back to a previous version of the engine from the System Health page.
   • CDownload another update from the IMS and Graymail page.
   • DDownload another update from the Service Updates page.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

10. Question 120 · 149 in bank

    Which setting affects the aggressiveness of spam detection?

    • Aprotection level
    • Bspam threshold
    • Cspam timeout
    • Dmaximum depth of recursion scan

    Show answer

    Answer: B

    Explanation

    Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118220-technote-esa-00.html

    Source: Adapted from community discussion — GVKD

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-720 practice, question 111. 149 questions available.