Which SMTP extension does Cisco ESA support for email security?
D
Explanation:
STARTTLS is an SMTP extension that allows email servers to negotiate a secure connection using TLS
or SSL encryption. Cisco ESA supports STARTTLS for both inbound and outbound email delivery.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 5-2.
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011000.html
Which feature utilizes sensor information obtained from Talos intelligence to filter email servers
connecting into the Cisco ESA?
A
Explanation:
SenderBase Reputation Filtering is a feature that allows Cisco ESA to reject or throttle connections
from email servers based on their reputation score, which is calculated by Talos using sensor
information from various sources.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 6-2.
When the Spam Quarantine is configured on the Cisco ESA, what validates end-users via LDAP during
login to the End-User Quarantine?
C
Explanation:
Spam Quarantine End-User Authentication Query is a query that Cisco ESA performs against an LDAP
server to validate the end-user credentials during login to the End-User Quarantine.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 10-9.
Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118692-configure-esa-00.html
Which benefit does enabling external spam quarantine on Cisco SMA provide?
D
Explanation:
External spam quarantine is a feature that allows Cisco SMA to store and manage spam messages
quarantined by multiple Cisco ESAs in one central location, providing a unified view and
administration of the spam quarantine data.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 10-3.
Reference:
https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma11-0/user_guide/b_SMA_Admin_Guide/b_SMA_Admin_Guide_chapter_010101.html
When email authentication is configured on Cisco ESA, which two key types should be selected on
the signing profile? (Choose two.)
BE
Explanation:
With DomainKeys or DKIM email authentication, the sender signs the email using public key
cryptography. Configuring DomainKeys and DKIM Signing A signing key is the private key stored on
the
appliance.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_010101.html?bookSearch
=true
What are two phases of the Cisco ESA email pipeline? (Choose two.)
BD
Explanation:
With DomainKeys or DKIM email authentication, the sender signs the email using public key
cryptography. Configuring DomainKeys and DKIM Signing A signing key is the private key stored on
the
appliance.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_010101.html?bookSearch
=true
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-1/user_guide/
b_ESA_Admin_Guide_12_1/b_ESA_Admin_Guide_12_1_chapter_011.pdf (p.1)
Which two action types are performed by Cisco ESA message filters? (Choose two.)
AD
Explanation:
Non-final actions are actions that do not terminate the message filter evaluation, such as adding
headers, setting variables, logging, etc. Final actions are actions that end the message filter
evaluation and determine the fate of the message, such as accept, drop, bounce, quarantine, etc.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 3-4.
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.html
Which setting affects the aggressiveness of spam detection?
B
Explanation:
Spam threshold is a setting that determines the minimum score that a message must have to be
classified as spam by Cisco ESA. The lower the threshold, the more aggressive the spam detection is.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 6-5.
Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118220-technote-esa-00.html
What is the order of virus scanning when multilayer antivirus scanning is configured?
D
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01011.html
According to the User Guide for AsyncOS 12.0 for Cisco Email Security Appliances2
, the order of virus
scanning when multilayer antivirus scanning is configured is as follows:
The McAfee engine scans the message first. If the McAfee engine detects a virus, the message is
dropped or repaired, depending on the configuration. If the McAfee engine does not detect a virus,
the message is passed to the next layer of scanning.
The Sophos engine scans the message second. If the Sophos engine detects a virus, the message is
dropped or repaired, depending on the configuration. If the Sophos engine does not detect a virus,
the message is delivered to the recipient.
Which antispam feature is utilized to give end users control to allow emails that are spam to be
delivered to their inbox, overriding any spam verdict and action on the Cisco ESA?
D
Explanation:
End user safelist is a feature that allows end users to specify email addresses or domains that they
want to receive messages from, regardless of the spam verdict or action assigned by Cisco ESA.
Messages from senders on the end user safelist are delivered to the end user’s inbox without any
spam filtering.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 10-13.
What are two prerequisites for implementing undesirable URL protection in Cisco ESA? (Choose
two.)
AC
Explanation:
Undesirable URL protection is a feature that allows Cisco ESA to detect and block messages that
contain URLs that lead to malicious or unwanted websites, such as phishing, malware, or adult
content sites. To enable this feature, outbreak filters and antispam scanning must be enabled on
Cisco ESA.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 6-17.
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01111.html
DRAG DROP
Drag and drop the steps to configure Cisco ESA to use SPF/SIDF verification from the left into the
correct order on the right.
Explanation:
Which suboption must be selected when LDAP is configured for Spam Quarantine End-User
Authentication?
A
Explanation:
According to the User Guide1
, the steps to configure End-User Access to the Spam Quarantine via
LDAP are as follows:
On the ESA, choose System Administration > LDAP > LDAP Server Profile page.
Click Add LDAP Server Profile.
Enter a name for the profile and click Submit.
Click Add Query.
Enter a name for the query and click Submit.
Configure the query settings, such as server address, port number, base DN, scope, filter, and
attributes.
Check the Spam Quarantine End-User Authentication Query check box. This is the suboption that
enables LDAP authentication for end users who access the spam quarantine.
Check the Designate as the active query check box. This is the suboption that specifies which query
to use for end-user authentication. Only one query can be active at a time.
Click Submit and commit changes.
On the ESA, choose Monitor > Spam Quarantine > End-User Quarantine Access.
Check the Enable End-User Quarantine Access check box.
Choose LDAP from the End-User Authentication drop-down list.
Select the LDAP profile and query that you created earlier from the drop-down lists.
Click Submit and commit changes.
Reference:
https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma11-5/user_guide/b_SMA_Admin_Guide_11_5/b_SMA_Admin_Guide_11_5_chapter_01010.html
Which action must be taken before a custom quarantine that is being used can be deleted?
D
Explanation:
Before a custom quarantine that is being used can be deleted, it must be removed from the message
action of any filter that is using it on Cisco ESA. Otherwise, an error message will appear stating that
the quarantine cannot be deleted because it is in use.
Reference:
User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway
, page 10-5.
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011111.html
DRAG DROP
An Encryption Profile has been set up on the Cisco ESA.
Drag and drop the steps from the left for creating an outgoing content filter to encrypt emails that
contains the subject "Secure:" into the correct order on the right.
Explanation:
Reference:
https://community.cisco.com/t5/email-security/keyword-in-subject-line-to-encrypt-message/td-
p/2441383