Securing Email with Cisco Email Security Appliance (SESA) practice questions

1. Question 1 of 25

   Which SMTP extension does Cisco ESA support for email security?

   • AETRN
   • BUTF8SMTP
   • CPIPELINING
   • DSTARTTLS

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Correct. AsyncOS supports the STARTTLS extension to SMTP (Secure SMTP over TLS), described in RFC 3207 (which obsoletes RFC 2487). https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011000.html?bookSearch=true

   Adapted from community discussion by GVKD · 2023-06-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion2

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2023-06-14

      Selected D2 upvotes

      Correct. AsyncOS supports the STARTTLS extension to SMTP (Secure SMTP over TLS), described in RFC 3207 (which obsoletes RFC 2487). https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011000.html?bookSearch=true

   2. X

      XalaGyan

      2025-02-10

      Selected D1 upvote

      Correct Answer: STARTTLS all other options are not related to security and some do not even exists

2. Question 2 of 25

   

   Refer to the exhibits. What must be done to enforce end user authentication before accessing quarantine?

   

   • AEnable SPAM notification and use LDAP for authentication.
   • BEnable SPAM Quarantine Notification and add the %quarantine_url% variable.
   • CChange the end user quarantine access from None authentication to SAAS.
   • DChange the end user quarantine access setting from None authentication to Mailbox.

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   A is the correct answer. Look at "Authentication Options for End Users Accessing Spam Management Features" section. In the Spam Notifications settings, deselect or select Enable login without credentials for quarantine access. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100000.html

   Adapted from community discussion by mipetric93 · 2024-07-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion2

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-29

      Selected D1 upvote

      D. Change the end user quarantine access setting from None authentication to Mailbox. By changing the end user quarantine access setting to Mailbox, the Cisco ESA will require users to authenticate themselves before accessing the quarantine. This authentication can be achieved through methods such as username and password credentials or single sign-on (SSO) integration with an existing authentication system. Options A and B mentioned in your question are related to SPAM notification and configuring the quarantine URL, but they do not specifically address end user authentication. Option C, changing the end user quarantine access to SAAS, is not relevant to enforcing end user authentication on the Cisco ESA.

   2. M

      mipetric93

      2024-07-04

      2 upvotes

      A is the correct answer. Look at "Authentication Options for End Users Accessing Spam Management Features" section. In the Spam Notifications settings, deselect or select Enable login without credentials for quarantine access. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100000.html

3. Question 3 of 25

   What is the default primary email attribute used in a spam quarantine end-user authentication query when using LDAP authentication to an Active Directory server?

   • AuserAccount
   • BmailLocalAddress
   • CsAMAccountName
   • DproxyAddresses

   Show answer

   Correct answer: C

   How others answered

   • C60%
   • D40%

   Only 60% agreed on this answer — treat it as contested rather than settled.

   Explanation

   C is Correct. AsyncOS uses one of the following default query strings for the end-user authentication query: -Active Directory: (sAMAccountName={u}) -OpenLDAP: (uid={u}) -Unknown or Other: [Blank] https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true

   Adapted from community discussion by GVKD · 2024-06-21 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion2

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-21

      Selected C4 upvotes

      C is Correct. AsyncOS uses one of the following default query strings for the end-user authentication query: -Active Directory: (sAMAccountName={u}) -OpenLDAP: (uid={u}) -Unknown or Other: [Blank] https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true

   2. M

      mipetric93

      2024-06-29

      3 upvotes

      D is the correct answare. By default, the primary email attribute is proxyAddresses for Active Directory servers and mail for OpenLDAP servers. You can enter your own query and email attributes. To create the query from the CLI, use the isqauth subcommand of the ldapconfig command. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011010.html

4. Question 4 of 25

   Select 2

   The Cisco ESA is processing many messages that are sent to invalid recipients. To reduce this excessive processing, an engineer is preparing to use LDAP for recipient verification. Which two steps are required to accomplish this task? (Choose two.)

   • AConfigure LDAP server profiles.
   • BEnable external LDAP authentication.
   • CConfigure the LDAP query.
   • DEnable LDAP authentication on a listener.
   • EConfigure incoming mail policy to query LDAP server.

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

   Explanation

   A and C are Correct. Directory Harvest Attack Prevention within the SMTP Conversation You can prevent DHAs by entering only domains in the Recipient Access Table (RAT), and performing the LDAP acceptance validation in the SMTP conversation. To drop messages during the SMTP conversation, configure an LDAP server profile for LDAP acceptance. Then, configure the listener to perform an LDAP accept query during the SMTP conversation. Once you configure LDAP acceptance queries for the listener, you must configure DHAP settings in the mail flow policy associated with the listener. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true#con_1163450

   Adapted from community discussion by GVKD · 2024-06-21 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-21

      Selected A, C3 upvotes

      A and C are Correct. Directory Harvest Attack Prevention within the SMTP Conversation You can prevent DHAs by entering only domains in the Recipient Access Table (RAT), and performing the LDAP acceptance validation in the SMTP conversation. To drop messages during the SMTP conversation, configure an LDAP server profile for LDAP acceptance. Then, configure the listener to perform an LDAP accept query during the SMTP conversation. Once you configure LDAP acceptance queries for the listener, you must configure DHAP settings in the mail flow policy associated with the listener. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true#con_1163450

   2. G

      GVKD

      2024-06-29

      1 upvote

      https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118218-configure-esa-00.html

   3. G

      GVKD

      2024-06-29

      1 upvote

      I disagree with D. LDAP authentication is used for End-User access not for verifying email adressess.

   4. H

      hakimbenda

      2024-06-27

      1 upvote

      A. Configure LDAP server profiles. D. Enable LDAP authentication on a listener.

5. Question 5 of 25

   An engineer must limit responses from the gateway that are directed to invalid email addresses. How should the LDAP server be configured to accomplish this goal?

   • AValidate the sender email address via an LDAP query during the SMTP conversation.
   • BValidate the sender email address via SMTP Call-Ahead to query an external SMTP server.
   • CLimit the number of invalid recipients per sender to stop responses after crossing the threshold.
   • DLimit the number of invalid responses per recipient to stop responses after crossing the threshold.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   C is Correct. In the mail flow policy associated with the listener, configure the following Directory Harvest Attack Prevention setting: -Max. Invalid Recipients Per hour. -Drop Connection if DHAP Threshold is reached within an SMTP conversation. -Max. Recipients Per Hour Code. -Max. Recipients Per Hour Text. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true#con_1163450

   Adapted from community discussion by GVKD · 2024-06-21 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-21

      Selected C3 upvotes

      C is Correct. In the mail flow policy associated with the listener, configure the following Directory Harvest Attack Prevention setting: -Max. Invalid Recipients Per hour. -Drop Connection if DHAP Threshold is reached within an SMTP conversation. -Max. Recipients Per Hour Code. -Max. Recipients Per Hour Text. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true#con_1163450

   2. G

      GVKD

      2024-07-02

      3 upvotes

      I disagree. "Next, configure the Mail Flow Policy to define the number of invalid recipient addresses the system will allow per sending IP address for a specific period of time. When this number is exceeded, the system will identify this condition as a DHA and send an alert message. The alert message will contain the following information:" https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011011.html?bookSearch=true#con_1163450

   3. H

      hakimbenda

      2024-06-27

      1 upvote

      D - Correct Options A and B do not directly address the goal of limiting responses to invalid email addresses. Option C focuses on limiting the number of invalid recipients per sender, which may not directly solve the problem of responses to invalid email addresses. Therefore, option D is the most appropriate choice for achieving the goal of limiting responses to invalid email addresses by configuring the LDAP server.

   4. G

      GVKD

      2024-07-02

      1 upvote

      "Next, configure the Mail Flow Policy to define the number of invalid recipient addresses the system will allow per sending IP address for a specific period of time. When this number is exceeded, the system will identify this condition as a DHA and send an alert message. The alert message will contain the following information:"

6. Question 6 of 25

   Select 2

   An administrator needs to configure Cisco ESA to ensure that emails are sent and authorized by the owner of the domain. Which two steps must be performed to accomplish this task? (Choose two.)

   • AGenerate keys.
   • BCreate signing profile.
   • CCreate Mx record.
   • DEnable SPF verification.
   • ECreate DMARC profile.

   Show answer

   Correct answer: A, B

   How others answered

   • AB33%
   • DE33%
   • AE22%

   Only 33% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Going with A and B are Correct. Configuring DomainKeys and DKIM Signing: -Signing Keys -Public Keys -Domain Profiles Creating Domain Profiles: Step 1 -Choose Mail Policies > Signing Profiles. Step 2 -In the Domain Signing Profiles section, click Add Profile. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_010110.html?bookSearch=true

   Adapted from community discussion by GVKD · 2024-07-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion3

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. H

      hakimbenda

      2024-06-27

      2 upvotes

      A. Generate keys. E. Create DMARC profile. To ensure that emails are sent and authorized by the owner of the domain, the following steps must be performed on Cisco ESA: A. Generate keys: Generate DomainKeys Identified Mail (DKIM) keys. DKIM is an email authentication method that allows the recipient to verify that an email was indeed sent by the domain it claims to be from. E. Create DMARC profile: DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a policy framework that builds upon SPF and DKIM to provide additional email authentication and reporting capabilities. By creating a DMARC profile, the administrator can define the desired policy for handling emails that fail SPF or DKIM checks and specify how receiving mail servers should handle such emails. These steps, generating keys and creating a DMARC profile, contribute to ensuring that emails are sent and authorized by the domain owner, providing improved email authentication and verification mechanisms.

   2. G

      GVKD

      2024-07-05

      Selected A, B2 upvotes

      Going with A and B are Correct. Configuring DomainKeys and DKIM Signing: -Signing Keys -Public Keys -Domain Profiles Creating Domain Profiles: Step 1 -Choose Mail Policies > Signing Profiles. Step 2 -In the Domain Signing Profiles section, click Add Profile. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_010110.html?bookSearch=true

   3. G

      GVKD

      2024-06-22

      Selected A, B1 upvote

      A and B are Correct. Configuring DomainKeys and DKIM Signing: -Signing Keys -Public Keys -Domain Profiles Creating Domain Profiles: Step 1 -Choose Mail Policies > Signing Profiles. Step 2 -In the Domain Signing Profiles section, click Add Profile. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_010110.html?bookSearch=true

7. Question 7 of 25

   Which suboption must be selected when LDAP is configured for Spam Quarantine End-User Authentication?

   • ADesignate as the active query
   • BUpdate Frequency
   • CServer Priority
   • DEntity ID

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma11-5/user_guide/b_SMA_Admin_Guide_11_5/ b_SMA_Admin_Guide_11_5_chapter_01010.html

   Supporting references

   • Cisco documentation

   View community discussion2

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-14

      Selected A1 upvote

      Correct. If you want the Spam Quarantine to use an LDAP query for end-user access, check the “Designate as the active query” check box. If there is an existing active query, it is disabled. When you open the System Administration > LDAP page, an asterisk (*) is displayed next to the active queries. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_11_1_chapter_011010.html?bookSearch=true

   2. M

      mkemm

      2022-02-15

      1 upvote

      To have the quarantine use an LDAP query for end-user access or spam notifications, select the “Designate as the active query” check box. You can designate one end-user authentication query to control quarantine access and one alias consolidation query for spam notifications. Any existing active queries are disabled. On the Security Management appliance, choose Management Appliance > System Administration > LDAP page, an asterisk (*) is displayed next to the active queries.

8. Question 8 of 25

   A Cisco ESA is configured such that emails with a reputation score above -6 are logged and those with a score below -6 are logged, encrypted, and then delivered. An email body contains a shortened URL that exceeds the nested shortened URLs limit. Which action is taken against the email?

   • AIt is encrypted but not logged.
   • BIt is logged but not encrypted.
   • CIt is logged and dropped.
   • DIt is logged and encrypted.

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   D is Correct. The shortened URL can be redirected to a maximum limit of 10 nested shortened URLs to determine the actual URL. If the shortened URL exceeds the maximum limit of 10 nested shortened URLs, a URL reputation score of -10 is assigned to the shortened URL by default. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01111.html

   Adapted from community discussion by GVKD · 2024-06-22 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion2

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-22

      Selected D4 upvotes

      D is Correct. The shortened URL can be redirected to a maximum limit of 10 nested shortened URLs to determine the actual URL. If the shortened URL exceeds the maximum limit of 10 nested shortened URLs, a URL reputation score of -10 is assigned to the shortened URL by default. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01111.html

   2. M

      mipetric93

      2024-06-29

      1 upvote

      B is correct answer, reputation score for shortened URL is above -6 which means that e-mail is only logged.

9. Question 9 of 25

   The CEO added a sender to a safelist but does not receive an important message expected from the trusted sender. An engineer evaluates message tracking on a Cisco ESA and determines that the message was dropped by the antivirus engine. What is the reason for this behavior?

   • AEnd-user safelists apply to antispam engines only.
   • BThe sender didn’t mark the message as urgent.
   • CAdministrative access is required to create a safelist.
   • DThe sender is included in an ISP blocklist.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Correct. Administrators and end users can use safelists and blocklists to help determine which messages are spam. Safelists specify senders and domains that are never treated as spam. Blocklists specify senders and domains that are always treated as spam. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

   Adapted from community discussion by GVKD · 2024-06-25 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion2

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

   1. G

      GVKD

      2024-06-25

      Selected A4 upvotes

      Correct. Administrators and end users can use safelists and blocklists to help determine which messages are spam. Safelists specify senders and domains that are never treated as spam. Blocklists specify senders and domains that are always treated as spam. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

   2. G

      GVKD

      2024-06-25

      Selected A1 upvote

      Correct. When end users want to access the spam quarantine on a Cisco ESA, they typically access it directly through a web browser. In order to ensure the security and privacy of the quarantined emails, authentication is required before granting access to the quarantine. This means that users need to provide valid credentials, such as a username and password, to authenticate themselves before accessing the quarantine interface. Options A and B are not accurate because the Guest role and access via a link in a notification are not specifically required restrictions for accessing the spam quarantine. Option C is partially correct as authentication is indeed required, but it specifically mentions accessing via a link in a notification, which may not be the only method of accessing the spam quarantine. https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100000.html?bookSearch=true#con_1624156

10. Question 10 of 25

    What is the maximum message size that can be configured for encryption on the Cisco ESA?

    • A20 MB
    • B25 MB
    • C15 MB
    • D30 MB

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Step 1 Click Security Services > Cisco IronPort Email Encryption. Step 2 Click Enable. Step 3 (Optional) Click Edit Settings to configure the following options: The maximum message size to encrypt. Cisco’s recommended message size is 10 MB. The maximum message size the appliance will encrypt is 25 MB. https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010011.html

    Adapted from community discussion by jolenzi · 2022-01-25 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. J

       jolenzi

       2022-01-25

       10 upvotes

       Step 1 Click Security Services > Cisco IronPort Email Encryption. Step 2 Click Enable. Step 3 (Optional) Click Edit Settings to configure the following options: The maximum message size to encrypt. Cisco’s recommended message size is 10 MB. The maximum message size the appliance will encrypt is 25 MB. https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010011.html

    2. G

       GVKD

       2024-06-14

       Selected B2 upvotes

       B is Correct. The maximum message size to encrypt. Cisco’s recommended message size is 10 MB. The maximum message size the appliance will encrypt is 25 MB. https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010011.html

    3. J

       jpapas

       2023-10-11

       2 upvotes

       B.25MB Enabling Message Encryption on the Email Gateway Procedure Step 1 Click Security Services > Cisco IronPort Email Encryption. Step 2 Click Enable. Step 3 (Optional) Click Edit Settings to configure the following options: The maximum message size to encrypt. Cisco’s recommended message size is 10 MB. The maximum message size the email gateway will encrypt is 25 MB.

    4. A

       a7mad150

       2023-11-17

       2 upvotes

       this is what ESA will show if you put more than 25 in Maximum Message Size to Encrypt: "Value must be from 1 to 25M."

11. Question 11 of 25

    An analyst creates a new content dictionary to use with Forged Email Detection. Which entry will be added into the dictionary?

    • Amycompany.com
    • BAlpha Beta
    • C^Alpha\ Beta$
    • D[email protected]

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/whitepaper_C11-737596.html

    Adapted from community discussion by jolenzi · 2022-01-25 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion3

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. J

       jolenzi

       2022-01-25

       5 upvotes

       B is correct. While creating a content dictionary, Enter the name of the user and not the email address. For example, enter “ Olivia Smith ” instead of “ [email protected] .” Do not configure Advanced Matching and Smart Identifiers. Do not choose weight for the terms used. Do not use regular expressions. https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010110.html#con_1260492

    2. G

       GVKD

       2024-06-14

       Selected B1 upvote

       B is Correct. Enter the name of the user and not the email address. For example, enter “ Olivia Smith ” instead of “ [email protected] .” https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010110.html#con_1260492

    3. J

       jpapas

       2023-10-11

       Selected B1 upvote

       https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_010110.html#con_1260492

12. Question 12 of 25

    Which process is skipped when an email is received from safedomain.com, which is on the safelist?

    • Amessage filter
    • Bantivirus scanning
    • Coutbreak filter
    • Dantispam scanning

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    D is the correct answer https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_011111.pdf For example, a message is sent to both recipient A and recipient B. Recipient A has safelisted the sender, whereas recipient B does not have an entry for the sender in the safelist or the blocklist. In this case, the message may be split into two messages with two message IDs. The message sent to recipient A is marked assafelisted with an X-SLBL-Result-Safelist header and skips anti-spam scanning, whereas the message bound for recipient B is scanned by the anti-spam scanning engine. Both messages then continue along the pipeline (through anti-virus scanning, content policies, and so on) and are subject to any configured settings.

    Adapted from community discussion by wernervv32 · 2023-03-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion2

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. W

       wernervv32

       2023-03-30

       Selected D2 upvotes

       D is the correct answer https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_011111.pdf For example, a message is sent to both recipient A and recipient B. Recipient A has safelisted the sender, whereas recipient B does not have an entry for the sender in the safelist or the blocklist. In this case, the message may be split into two messages with two message IDs. The message sent to recipient A is marked assafelisted with an X-SLBL-Result-Safelist header and skips anti-spam scanning, whereas the message bound for recipient B is scanned by the anti-spam scanning engine. Both messages then continue along the pipeline (through anti-virus scanning, content policies, and so on) and are subject to any configured settings.

    2. G

       GVKD

       2024-06-14

       Selected D1 upvote

       D is Correct. Administrators and end users can use safelists and blocklists to help determine which messages are spam. Safelists specify senders and domains that are never treated as spam. Blocklists specify senders and domains that are always treated as spam. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011111.html?bookSearch=true

13. Question 13 of 25

    Which feature utilizes sensor information obtained from Talos intelligence to filter email servers connecting into the Cisco ESA?

    • ASenderBase Reputation Filtering
    • BConnection Reputation Filtering
    • CTalos Reputation Filtering
    • DSpamCop Reputation Filtering

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Correct. SenderBase Reputation Service The Cisco SenderBase Reputation Service, using global data from the SenderBase Affiliate network, assigns a SenderBase Reputation Score to email senders https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101.html?bookSearch=true

    Adapted from community discussion by GVKD · 2023-06-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2023-06-14

       Selected A2 upvotes

       Correct. SenderBase Reputation Service The Cisco SenderBase Reputation Service, using global data from the SenderBase Affiliate network, assigns a SenderBase Reputation Score to email senders https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101.html?bookSearch=true

    2. X

       XalaGyan

       2025-02-10

       Selected A1 upvote

       Correct Answer: A SenderBase is the correct feature name on Talos. the others are not features of Talos related to Emails.

14. Question 14 of 25

    Select 2

    Which two actions are configured on the Cisco ESA to query LDAP servers? (Choose two.)

    • Aaccept
    • Brelay
    • Cdelay
    • Droute
    • Ereject

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_011010.html

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-15

       Selected A, D1 upvote

       Correct. If you store user information within LDAP directories in your network infrastructure you can configure the appliance to query your LDAP servers to accept, route, and authenticate messages. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_011010.html

    2. S

       samismayilov

       2022-03-29

       1 upvote

       Correct. When you configure your appliance to work with an LDAP directory, you must complete the following steps to configure your AsyncOS appliance for acceptance, routing, aliasing, and masquerading:

15. Question 15 of 25

    Which method enables an engineer to deliver a flagged message to a specific virtual gateway address in the most flexible way?

    • ASet up the interface group with the flag.
    • BIssue the altsrchost command.
    • CMap the envelope sender address to the host.
    • DApply a filter on the message.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/ b_ESA_Admin_Guide_chapter_01000.html#con_1133810

    Adapted from community discussion by GVKD · 2024-06-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-11

       Selected D2 upvotes

       D is Correct: Users requiring more power and flexibility in mapping messages to particular Virtual Gateways should investigate the use of message filters. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011001.html

    2. D

       Dagio78

       2024-04-29

       1 upvote

       Answer D not B https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011001.html The altsrchost command provides the simplest and most straightforward method to segment each appliance into multiple IP interfaces (Virtual Gateway addresses) from which to deliver email. However, users requiring more power and flexibility in mapping messages to particular Virtual Gateways should investigate the use of message filters. See Using Message Filters to Enforce Email Policiesfor more information.

    3. D

       Dagio78

       2024-04-29

       1 upvote

       Answer B https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011001.html The altsrchost command provides the simplest and most straightforward method to segment each appliance into multiple IP interfaces (Virtual Gateway addresses) from which to deliver email. However, users requiring more power and flexibility in mapping messages to particular Virtual Gateways should investigate the use of message filters. See Using Message Filters to Enforce Email Policiesfor more information.

    4. J

       jolenzi

       2022-01-25

       2 upvotes

       Correct. https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118132-configure-esa-00.html

16. Question 16 of 25

    Which feature must be configured before an administrator can use the outbreak filter for nonviral threats?

    • Aquarantine threat level
    • Bantispam
    • Cdata loss prevention
    • Dantivirus

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01110.html

    Adapted from community discussion by jolenzi · 2022-01-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. J

       jolenzi

       2022-01-26

       2 upvotes

       Correct. "By default, the Outbreak Filters feature scans your incoming and outgoing messages for possible viruses during an outbreak. You can enable scanning for non-viral threats in addition to virus outbreaks if you enable anti-spam scanning on the appliance." https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01110.html

    2. S

       samismayilov

       2022-03-29

       1 upvote

       Your appliance needs a feature key for Anti-Spam or Intelligent Multi-Scan in order for Outbreak Filters to scan for non-viral threats.

17. Question 17 of 25

    Select 2

    When outbreak filters are configured, which two actions are used to protect users from outbreaks? (Choose two.)

    • Aredirect
    • Breturn
    • Cdrop
    • Ddelay
    • Eabandon

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01110.html

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. M

       mkemm

       2022-02-23

       1 upvote

       The Outbreak Filters feature uses three tactics to protect your users from outbreaks: Delay. Outbreak Filters quarantines messages that may be part of a virus outbreak or non-viral attack. While quarantined, the appliances receives updated outbreak information and rescans the message to confirm whether it’s part of an attack. Redirect. Outbreak Filters rewrites the URLs in non-viral attack messages to redirect the recipient through the Cisco web security proxy if they attempt to access any of the linked websites. The proxy displays a splash screen that warns the user that the website may contain malware, if the website is still operational, or displays an error message if the website has been taken offline. See Redirecting URLs for more information on redirecting URLs. Modify. In addition to rewriting URLs in non-viral threat messages, Outbreak Filters can modify a message’s subject and add a disclaimer above the message body to warn users about the message’s content. See Modifying Messages for more information.

    2. G

       GVKD

       2024-06-12

       Selected A, D2 upvotes

       Correct. The Outbreak Filters feature uses three tactics to protect your users from outbreaks: Delay. Redirect. Modify. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01110.html

18. Question 18 of 25

    Which benefit does enabling external spam quarantine on Cisco SMA provide?

    • Aability to back up spam quarantine from multiple Cisco ESAs to one central console
    • Baccess to the spam quarantine interface on which a user can release, duplicate, or delete
    • Cability to scan messages by using two engines to increase a catch rate
    • Dability to consolidate spam quarantine data from multiple Cisco ESA to one central console

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Correct. Centralized Policy, Virus, and Outbreak Quarantines You can centralize policy, virus, and outbreak quarantines on a Security Management appliance. Messages are processed by Email Security appliances but are stored in quarantines on the Security Management appliance. Centralizing policy, virus, and outbreak quarantines offers the following benefits: Administrators can manage quarantined messages from multiple Email Security appliances in one location. Quarantined messages are stored behind the firewall instead of in the DMZ, reducing security risk. Centralized quarantines can be backed up using the standard backup functionality on the Security Management appliance. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101010.html?bookSearch=true#con_1154400

    Adapted from community discussion by GVKD · 2023-06-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2023-06-14

       Selected D2 upvotes

       Correct. Centralized Policy, Virus, and Outbreak Quarantines You can centralize policy, virus, and outbreak quarantines on a Security Management appliance. Messages are processed by Email Security appliances but are stored in quarantines on the Security Management appliance. Centralizing policy, virus, and outbreak quarantines offers the following benefits: Administrators can manage quarantined messages from multiple Email Security appliances in one location. Quarantined messages are stored behind the firewall instead of in the DMZ, reducing security risk. Centralized quarantines can be backed up using the standard backup functionality on the Security Management appliance. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_0101010.html?bookSearch=true#con_1154400

    2. X

       XalaGyan

       2025-02-10

       Selected D1 upvote

       Correct Answer: D Spam consolidation over backup. Why would you want to backup spam? Correct is to consolidate the entire spam emails into one central location for scanning, deleting, treatment etc.

19. Question 19 of 25

    What must be configured to allow the Cisco ESA to encrypt an email using the Cisco Registered Envelope Service?

    • Aprovisioned email encryption profile
    • Bmessage encryption from a content filter that select "Message Encryption" over TLS
    • Cmessage encryption from the mail flow policies with "CRES" selected
    • Dcontent filter to forward the email to the Cisco Registered Envelope server

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010010.html

    Adapted from community discussion by GVKD · 2024-06-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion2

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-12

       Selected A2 upvotes

       A is the correct answer. AsyncOS supports using encryption to secure inbound and outbound email. To use this feature, you create an encryption profile that specifies characteristics of the encrypted message and connectivity information for the key server. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010010.html

    2. M

       mkemm

       2022-03-04

       2 upvotes

       https://www.cisco.com/c/dam/en/us/products/collateral/security/esa-cres-encryption.pdf, so it is answer A

20. Question 20 of 25

    Select 2

    Which two configurations are used on multiple LDAP servers to connect with Cisco ESA? (Choose two.)

    • Aload balancing
    • BSLA monitor
    • Cactive-standby
    • Dfailover
    • Eactive-active

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    You can enter multiple host names to configure the LDAP servers for failover or load-balancing. Separate multiple entries with commas. Reference: https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/sma_user_guide/b_SMA_Admin_Guide_ces_11/ b_SMA_Admin_Guide_chapter_01010.html

    Adapted from community discussion by GVKD · 2024-06-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-12

       Selected A, D2 upvotes

       Correct. You can use multiple LDAP servers to achieve the following results: Failover. When you configure the LDAP profile for failover, the appliance fails over to the next LDAP server in the list if it cannot connect to the first LDAP server. Load Balancing. When you configure the LDAP profile for load balancing, the appliance distributes connections across the list of LDAP servers when it performs LDAP queries. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_011010.html#con_1216413

    2. I

       iluxa

       2022-03-06

       1 upvote

       https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_011010.html#con_1216413 , correct

21. Question 21 of 25

    Select 2

    Which two steps are needed to disable local spam quarantine before external quarantine is enabled? (Choose two.)

    • AUncheck the Enable Spam Quarantine check box.
    • BSelect Monitor and click Spam Quarantine.
    • CCheck the External Safelist/Blocklist check box.
    • DSelect External Spam Quarantine and click on Configure.
    • ESelect Security Services and click Spam Quarantine.

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118555-qa-esa-00.html (configuration summary)

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-12

       Selected A, B1 upvote

       Correct. Configuration Summary: 1) Enable centralized quarantine on the ESA appliance(s):GUI > Security Services > Spam Quarantine >Check Enable External Spam Quarantine 2) Disable the local quarantine(s):GUI > Monitor > Spam Quarantine> Uncheck Enable Spam Quarantine 3) Submit and Commit Changes. https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118555-qa-esa-00.html

    2. I

       iluxa

       2022-03-08

       1 upvote

       Configuration Summary Enable centralized quarantine on the ESA appliance(s):GUI > Security Services > Spam Quarantine >Check Enable External Spam Quarantine Disable the local quarantine(s):GUI > Monitor > Spam Quarantine> Uncheck Enable Spam Quarantine Submit and Commit Changes. Optionally migrate quarantine messages from local to central quarantine via the process below.

22. Question 22 of 25

    Select 2

    Which two certificate authority lists are available in Cisco ESA? (Choose two.)

    • Adefault
    • Bsystem
    • Cuser
    • Dcustom
    • Edemo

    Show answer

    Correct answer: B, D

    How others answered

    • BD100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/ b_ESA_Admin_Guide_11_1_chapter_011000.html#task_1194859

    Adapted from community discussion by MarcioSantos51 · 2022-08-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion3

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-13

       Selected B, D1 upvote

       Correct. Managing Lists of Certificate Authorities The appliance uses stored trusted certificate authorities that it uses to verify a certificate from a remote domain to establish the domain’s credentials. You can configure the appliance to use the following trusted certificate authorities: Pre-installed list. The appliance has a pre-installed list of trusted certificate authorities. This is called the system list. User-defined list. You can customize a list of trusted certificate authorities and then import the list onto the appliance. You can use either the system list or the customized list, and you can also use both lists to verify certificate from a remote domain. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011000.html?bookSearch=true

    2. M

       MarcioSantos51

       2022-08-17

       2 upvotes

       The appliance uses stored trusted certificate authorities that it uses to verify a certificate from a remote domain to establish the domain’s credentials. You can configure the appliance to use the following trusted certificate authorities: Pre-installed list. The appliance has a pre-installed list of trusted certificate authorities. This is called the system list. User-defined list. You can customize a list of trusted certificate authorities and then import the list onto the appliance .

    3. P

       patataatomica

       2023-11-02

       1 upvote

       Correct. Networks> Certificates > Edit Certificate Authorities. You chan choose between Custom List and System List.

23. Question 23 of 25

    What is the default HTTPS port when configuring spam quarantine on Cisco ESA?

    • A83
    • B82
    • C443
    • D80

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Correct. In the Spam Quarantine section, configure settings for access to the spam quarantine: By default, HTTP uses port 82 and HTTPS uses port 83. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011111.html?bookSearch=true

    Adapted from community discussion by GVKD · 2024-06-13 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-13

       Selected A3 upvotes

       Correct. In the Spam Quarantine section, configure settings for access to the spam quarantine: By default, HTTP uses port 82 and HTTPS uses port 83. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_011111.html?bookSearch=true

    2. I

       iluxa

       2022-03-04

       3 upvotes

       A is correct : https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100000.html#task_1537411

    3. J

       jaciro11

       2023-01-26

       Selected A1 upvote

       Its 83, 82 for http https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118692-configure-esa-00.pdf

    4. C

       ccnpsise

       2023-07-26

       1 upvote

       In the Spam Quarantine section, configure settings for access to the spam quarantine: By default, HTTP uses port 82 and HTTPS uses port 83. Correct Answer is 83

24. Question 24 of 25

    Which scenario prevents a message from being sent to the quarantine as an action in the scan behavior on Cisco ESA?

    • AA policy quarantine is missing.
    • BMore than one email pipeline is defined.
    • CThe "modify the message subject" is already set.
    • DThe "add custom header" action is performed first.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A is Correct. Sending Message to Policy Quarantine: When flagged for quarantine, the message that is not scanned by the Content Scanner continues through the rest of the email pipeline. When the message reaches the end of the pipeline, if the message has been flagged for one or more quarantines then it enters those queues. Note that if the message does not reach the end of the pipeline, it is not placed in a quarantine. For example, a content filter can cause a message to be dropped or bounced, in which case the message will not be quarantined. Note: If a policy quarantine is not defined in your appliance , you cannot sent the message to the quarantine. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01000.html?bookSearch=true#con_1371434

    Adapted from community discussion by GVKD · 2024-06-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-15

       Selected A2 upvotes

       A is Correct. Sending Message to Policy Quarantine: When flagged for quarantine, the message that is not scanned by the Content Scanner continues through the rest of the email pipeline. When the message reaches the end of the pipeline, if the message has been flagged for one or more quarantines then it enters those queues. Note that if the message does not reach the end of the pipeline, it is not placed in a quarantine. For example, a content filter can cause a message to be dropped or bounced, in which case the message will not be quarantined. Note: If a policy quarantine is not defined in your appliance , you cannot sent the message to the quarantine. https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01000.html?bookSearch=true#con_1371434

    2. P

       pepgua

       2022-10-21

       1 upvote

       A seems correct to me.. Note under - Sending Message to Policy Quarantine https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01000.html?bookSearch=true

25. Question 25 of 25

    Select 2

    What are two primary components of content filters? (Choose two.)

    • Aconditions
    • Bsubject
    • Ccontent
    • Dactions
    • Epolicies

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_01010.pdf

    Adapted from community discussion by GVKD · 2024-06-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion2

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-720 or CertExamHQ.

    1. G

       GVKD

       2024-06-15

       Selected A, D2 upvotes

       Correct. Content filters have the following components: • conditions that determine when the appliance uses a content filter to scan a message (optional) • actions that the appliance takes on a message (required) • action variables that the appliance can add to a message when modifying it (optional) https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_01010.pdf

    2. C

       ccnpsise

       2023-08-01

       2 upvotes

       there is a new Q i am not sure about how the Q was constructed but it is something about a company employs a user help desk to assist in message quaratine and which right should be given to him to fulfil this task. options are Administrator,User help desk, Technician, Quarantine Administrator. 10% of the questions here came out in my exam today

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-720 practice, question 1 of 25