QUESTION: 57

Which action on the Cisco ESA provides direct access to view the safelist/blocklist?

Show the SLBL cache on the CLI.
Monitor Incoming/Outgoing Listener.
Export the SLBL to a .csv file.
Debug the mail flow policy.

Answer(s): C

Explanation:

The safelist/blocklist (SLBL) is a feature that allows Cisco ESA to accept or reject messages from specific email addresses or domains, based on the configuration of mail flow policies or end user preferences.
The action that provides direct access to view the SLBL on Cisco ESA is to export the SLBL to a .csv file, which can be done from the web user interface by selecting Security Services > Safelist/Blocklist and clicking Export.
The other options do not provide direct access to view the SLBL on Cisco ESA.

Reference:

User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 6-13 and page 6-14.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117922- technote- esa-00.html

Reveal Solution Next Question

QUESTION: 58

Which scenario prevents a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA?

A policy quarantine is missing.
More than one email pipeline is defined.
The "modify the message subject" is already set.
The "add custom header" action is performed first.

Answer(s): A

Explanation:

A policy quarantine is a type of quarantine that allows Cisco ESA to store messages that match certain criteria, such as virus, spam, or DLP verdicts, for further review or release by an administrator or an end user.
A scenario that prevents a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA is when a policy quarantine is missing, which means that no policy quarantine has been created or enabled on Cisco ESA.
The other options do not prevent a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA.

Reference:

User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-2 and page 10-3.

Reveal Solution Next Question

QUESTION: 59

What are two primary components of content filters? (Choose two.)

conditions
subject
content
actions
policies

Answer(s): A,D

Explanation:

Content filters are rules that allow Cisco ESA to perform actions on messages based on predefined or custom conditions, such as headers, envelope, body, attachments, etc.
The two primary components of content filters are:
Conditions, which are the criteria that determine whether a message matches a content filter rule or not, such as message size, sender address, attachment type, etc. Actions, which are the operations that Cisco ESA performs on a message if it matches the conditions of a content filter rule, such as deliver, drop, quarantine, encrypt, etc. The other options are not primary components of content filters on Cisco ESA.

Reference:

User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 8-3 and page 8-4.

https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/ b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_01010.pdf

Reveal Solution Next Question

QUESTION: 60

A network administrator is modifying an outgoing mail policy to enable domain protection for the organization. A DNS entry is created that has the public key.

Which two headers will be used as matching criteria in the outgoing mail policy? (Choose two.)

message-ID
sender
URL reputation
from
mail-from

Answer(s): B,D

Explanation:

To enable domain protection for the organization, the administrator must configure an outgoing mail policy that matches the sender and the from headers of the email. The sender header is the envelope sender address that is used by SMTP to route the email. The from header is the address that is displayed to the recipient as the source of the email. These headers are used to generate and verify a DomainKeys Identified Mail (DKIM) signature, which is a cryptographic method of validating the authenticity and integrity of an email message.
The other headers are not relevant for domain protection. The message-ID header is a unique identifier for each email message. The URL reputation header is a score that indicates the likelihood of a URL being malicious. The mail-from header is an alias for the sender header.

Reference:

Domain Protection
DKIM Signing

Reveal Solution Next Question

Free 300-720 Exam Braindumps (page: 15)

QUESTION: 57

Explanation:

Reference:

QUESTION: 58

Explanation:

Reference:

QUESTION: 59

Explanation:

Reference:

QUESTION: 60

Explanation:

Reference: