300-720 practice questions 41–50

1. Question 41 · 149 in bank

   Select 2

   Which two Cisco ESA features are used to control email delivery based on the sender? (Choose two.)

   • Aincoming mail policies
   • Bspam quarantine
   • Coutbreak filter
   • Dsafelists
   • Eblocklists

   Show answer

   Answer: DE

   Explanation

   Correct. Using Safelists and Blocklists to Control Email Delivery Based on Sender. Administrators and end users can use safelists and blocklists to help determine which messages are spam. Safelists specify senders and domains that are never treated as spam. Blocklists specify senders and domains that are always treated as spam. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

   Source: Adapted from community discussion — GVKD

   References

   • Cisco documentation

   Next question

2. Question 42 · 149 in bank

   Select 2

   An organization wants to designate help desk personnel to assist with tickets that request the release of messages from the spam quarantine because company policy does not permit end-user quarantine access to employees directly. Which two roles must be used for these personnel to release messages while restricting access to make configuration changes in the Cisco ESA? (Choose two.)

   • AAdministrator
   • BRead-Only Operator
   • CTechnician
   • DQuarantine Administrator
   • EHelp Desk User

   Show answer

   Answer: BE

   Explanation

   B and E are Correct. All users with administrator privileges can change spam quarantine settings and view and manage messages in the spam quarantine. You do not need to configure spam quarantine access for administrator users. If you configure access to the spam quarantine for users with the following roles, they can view, release, and delete messages in the spam quarantine: -Operator -Read-only operator -Help desk user -Guest -Custom user roles that have spam quarantine privileges These users cannot access spam quarantine settings. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

   Source: Adapted from community discussion — GVKD

   References

   • Cisco documentation

   Next question

3. Question 43 · 149 in bank

   The CEO sent an email indicating that all emails containing a string of 123ABCDEFGHJ cannot be delivered and must be sent into quarantine for further inspection. Given the requirement, which regular expression should be used to match on that criteria?

   • A\d{3}[A–Z]{9}
   • B{3}\d{9}[A–Z]
   • C\w{3}[A–Z]{9}
   • D\\D{3}[A–Z]{9}

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

4. Question 44 · 149 in bank

   

   Refer to the exhibit. A network engineer must set up a content filter to find any messages that failed SPF and send them into quarantine. The content filter has been set up and enabled, but all messages except those that have failed SPF are being sent into quarantine. Which section of the filter must be modified to correct this behavior?

   • Alog-entry
   • Bquarantine
   • Cspf-status
   • Dskip-filters

   Show answer

   Answer: C

   Explanation

   Correct. You can check against the SPF/SIDF verification results using the following syntax: if (spf-status == "Pass") If you want a single condition to check against multiple status verdicts, you can use the following syntax: if (spf-status == "PermError, TempError") You can also check the verification results against the HELO, MAIL FROM, and PRA identities using the following syntax: if (spf-status("pra") == "Fail") https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_01000.html?bookSearch=true#con_1132105

   Source: Adapted from community discussion — GVKD

   References

   • Cisco documentation

   Next question

5. Question 45 · 149 in bank

   Which restriction is in place for end users accessing the spam quarantine on Cisco ESA devices?

   • AThe end user must be assigned to the Guest role.
   • BAccess via a link in a notification in mandatory.
   • CAuthentication is required when accessing via a link in a notification.
   • DDirect access via web browser requires authentication.

   Show answer

   Answer: D

   Explanation

   D is Correct. When end users want to access the spam quarantine on a Cisco ESA, they typically access it directly through a web browser. In order to ensure the security and privacy of the quarantined emails, authentication is required before granting access to the quarantine. This means that users need to provide valid credentials, such as a username and password, to authenticate themselves before accessing the quarantine interface. Options A and B are not accurate because the Guest role and access via a link in a notification are not specifically required restrictions for accessing the spam quarantine. Option C is partially correct as authentication is indeed required, but it specifically mentions accessing via a link in a notification, which may not be the only method of accessing the spam quarantine.

   Source: Adapted from community discussion — GVKD

   Next question

6. Question 46 · 149 in bank

   Which action must be taken before a custom quarantine that is being used can be deleted?

   • ADelete the quarantine that is assigned to a filter.
   • BDelete the quarantine that is not assigned to a filter.
   • CDelete only the unused quarantine.
   • DRemove the quarantine from the message action of a filter.

   Show answer

   Answer: D

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/ b_ESA_Admin_Guide_12_0_chapter_011111.html

   References

   • Cisco documentation

   Next question

7. Question 47 · 149 in bank

   An organization has multiple Cisco ESA devices deployed, resulting in several spam quarantines to manage. To manage the quarantined messages, the administrator enabled the centralized spam quarantine on the Cisco SMA and configured the external spam quarantine on the Cisco ESA devices. However, messages are still being directed to the local quarantine on the Cisco ESA devices. What change is necessary to complete the configuration?

   • AModify the incoming mail policies on the Cisco ESA devices to redirect to the external quarantine.
   • BDisable the external spam quarantine on the Cisco ESA devices.
   • CDisable the local spam quarantine on the Cisco ESA devices.
   • DModify the external spam quarantine settings on the Cisco ESA devices and change the port to 25.

   Show answer

   Answer: C

   Next question

8. Question 48 · 149 in bank

   The CEO added a sender to a safelist but does not receive an important message expected from the trusted sender. An engineer evaluates message tracking on a Cisco ESA and determines that the message was dropped by the antivirus engine. What is the reason for this behavior?

   • AEnd-user safelists apply to antispam engines only.
   • BThe sender didn’t mark the message as urgent.
   • CAdministrative access is required to create a safelist.
   • DThe sender is included in an ISP blocklist.

   Show answer

   Answer: A

   Explanation

   Correct. Administrators and end users can use safelists and blocklists to help determine which messages are spam. Safelists specify senders and domains that are never treated as spam. Blocklists specify senders and domains that are always treated as spam. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

   Source: Adapted from community discussion — GVKD

   References

   • Cisco documentation

   Next question

9. Question 49 · 149 in bank

   DRAG DROP - An Encryption Profile has been set up on the Cisco ESA. Drag and drop the steps from the left for creating an outgoing content filter to encrypt emails that contains the subject "Secure:" into the correct order on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://community.cisco.com/t5/email-security/keyword-in-subject-line-to-encrypt-message/td-p/2441383

   References

   • cisco.com documentation

   

   Next question

10. Question 50 · 149 in bank

    What is the maximum message size that can be configured for encryption on the Cisco ESA?

    • A20 MB
    • B25 MB
    • C15 MB
    • D30 MB

    Show answer

    Answer: B

    Explanation

    Step 1 Click Security Services > Cisco IronPort Email Encryption. Step 2 Click Enable. Step 3 (Optional) Click Edit Settings to configure the following options: The maximum message size to encrypt. Cisco’s recommended message size is 10 MB. The maximum message size the appliance will encrypt is 25 MB. https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010011.html

    Source: Adapted from community discussion — jolenzi

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-720 practice, question 41. 149 questions available.