QUESTION: 77

Refer to the exhibit.
Which configuration on the scan behavior must be updated to allow the attachment to be scanned on the Cisco ESA?

Add an additional mapping for attachment type for zip files.
Enable assume match pattern if the email was not scanned for any reason.
Increase the maximum recursion depth from 5 to a larger value.
Increase the maximum attachment size to scan to a larger value.

Answer(s): D

Explanation:

The maximum attachment size to scan is a configuration on the scan behavior that determines the maximum size of an attachment that Cisco ESA will scan for viruses and malware. If an attachment exceeds this size, Cisco ESA will apply the configured action for unscannable messages, such as deliver, drop, or quarantine.
To allow the attachment to be scanned on the Cisco ESA, this configuration must be updated to a larger value than the attachment size, which is 10 MB according to the message header. The other options are not valid configurations to allow the attachment to be scanned on the Cisco ESA, because they do not affect the maximum attachment size to scan.

Reference:

User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 7-3 and page 7-4.

Reveal Solution Next Question

QUESTION: 78

Users have been complaining of a higher volume of emails containing profanity. The network administrator will need to leverage dictionaries and create specific conditions to reduce the number of inappropriate emails.

Which two filters should be configured to address this? (Choose two.)

message
spam
VOF
sender group
content

Answer(s): A,E

Explanation:

Message filter and content filter are two filters that should be configured to address this issue. Message filter and content filter are rules that allow Cisco ESA to perform actions on messages based on predefined or custom conditions, such as headers, envelope, body, attachments, etc. To reduce the number of inappropriate emails containing profanity, the network administrator can create a dictionary that contains a list of profane words or phrases and use it as a condition in a message filter or content filter that applies an action of "drop", "quarantine", or "modify subject" on the matching messages.
The other options are not valid filters to address this issue, because they do not use dictionaries or conditions based on message content.

Reference:

User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 8-3 and page 8-7.

Reveal Solution Next Question

QUESTION: 79

Refer to the exhibit.
What is the correct order of commands to set filter 2 to active?

filters-> edit-> 2-> Active
filters-> modify-> All-> Active
filters-> detail-> 2-> 1
filters-> set-> 2-> 1

Answer(s): D

Explanation:

The correct order of commands to set filter 2 to active on the CLI of Cisco ESA is:
filters, which enters the message filter mode.
set, which sets the status of one or more message filters.
2, which specifies the message filter number.
1, which sets the status of message filter 2 to active.

The other options are not valid orders of commands to set filter 2 to active on the CLI of Cisco ESA, because they use incorrect commands or parameters.

Reference:

User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page A-6 and page A-7.

Reveal Solution Next Question

QUESTION: 80

A network administrator notices that there are a high number of queries to the LDAP server. The mail logs show an entry "550 Too many invalid recipients | Connection closed by foreign host."

Which feature must be used to address this?

DHAP
SBRS
LDAP
SMTP

Answer(s): A

Reference:

https://www.cisco.com/c/en/us/td/docs/security/esa/esa12- 0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011010.html

DHAP (Directory Harvest Attack Prevention) is a feature that must be used to address this issue. DHAP is a mechanism that allows Cisco ESA to prevent directory harvest attacks, which are attempts by spammers or hackers to obtain valid email addresses from an LDAP server by sending messages with random or guessed recipients and checking for bounce messages. To enable DHAP on Cisco ESA, the network administrator can follow these steps:
Select Network > Listeners and click Edit Settings for the listener that receives incoming messages. Under SMTP Authentication Settings, select Enable Directory Harvest Attack Prevention. Enter a value for Maximum Invalid Recipients per Hour, which is the number of invalid recipients that triggers DHAP.
Enter a value for Block Sender for (hours), which is the duration that Cisco ESA blocks messages from senders who exceed the maximum invalid recipients per hour.
Click Submit.

Reveal Solution Next Question

Free 300-720 Exam Braindumps (page: 20)

QUESTION: 77

Explanation:

Reference:

QUESTION: 78

Explanation:

Reference:

QUESTION: 79

Explanation:

Reference:

QUESTION: 80

Reference: