Which global setting is configured under Cisco ESA Scan Behavior?
Answer(s): C
The global setting that is configured under Cisco ESA Scan Behavior is the actions for unscannable messages due to attachment type. This setting allows the administrator to specify what action to take when a message contains an attachment that cannot be scanned by the appliance, such as encrypted or password-protected files. The possible actions are:Deliver - Deliver the message normally. Drop - Drop the message silently without notifying the sender or recipient. Quarantine - Quarantine the message in a specified policy quarantine. Bounce - Bounce the message back to the sender with a specified reason.
Scan Behaviorhttps://community.cisco.com/t5/email-security/cisco-ironport-esa-security-services-scan- behavior- impact-on-av/td-p/3923243
Which action on the Cisco ESA provides direct access to view the safelist/blocklist?
The safelist/blocklist (SLBL) is a feature that allows Cisco ESA to accept or reject messages from specific email addresses or domains, based on the configuration of mail flow policies or end user preferences.The action that provides direct access to view the SLBL on Cisco ESA is to export the SLBL to a .csv file, which can be done from the web user interface by selecting Security Services > Safelist/Blocklist and clicking Export.The other options do not provide direct access to view the SLBL on Cisco ESA.
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 6-13 and page 6-14.https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117922- technote- esa-00.html
Which scenario prevents a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA?
Answer(s): A
A policy quarantine is a type of quarantine that allows Cisco ESA to store messages that match certain criteria, such as virus, spam, or DLP verdicts, for further review or release by an administrator or an end user.A scenario that prevents a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA is when a policy quarantine is missing, which means that no policy quarantine has been created or enabled on Cisco ESA.The other options do not prevent a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA.
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-2 and page 10-3.
What are two primary components of content filters? (Choose two.)
Answer(s): A,D
Content filters are rules that allow Cisco ESA to perform actions on messages based on predefined or custom conditions, such as headers, envelope, body, attachments, etc.The two primary components of content filters are:Conditions, which are the criteria that determine whether a message matches a content filter rule or not, such as message size, sender address, attachment type, etc. Actions, which are the operations that Cisco ESA performs on a message if it matches the conditions of a content filter rule, such as deliver, drop, quarantine, encrypt, etc. The other options are not primary components of content filters on Cisco ESA.
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 8-3 and page 8-4.https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/ b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_01010.pdf
A network administrator is modifying an outgoing mail policy to enable domain protection for the organization. A DNS entry is created that has the public key.Which two headers will be used as matching criteria in the outgoing mail policy? (Choose two.)
Answer(s): B,D
To enable domain protection for the organization, the administrator must configure an outgoing mail policy that matches the sender and the from headers of the email. The sender header is the envelope sender address that is used by SMTP to route the email. The from header is the address that is displayed to the recipient as the source of the email. These headers are used to generate and verify a DomainKeys Identified Mail (DKIM) signature, which is a cryptographic method of validating the authenticity and integrity of an email message.The other headers are not relevant for domain protection. The message-ID header is a unique identifier for each email message. The URL reputation header is a score that indicates the likelihood of a URL being malicious. The mail-from header is an alias for the sender header.
Domain ProtectionDKIM Signing
Post your Comments and Discuss Cisco 300-720 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 300-720 content, but please register or login to continue.