Question 1

Which global setting is configured under Cisco ESA Scan Behavior?

Accepted Answer

A)  minimum attachment size to scan 
B)  attachment scanning timeout 
C)  actions for unscannable messages due to attachment type 
D)  minimum depth of attachment recursion to scan 
A)  minimum attachment size to scan 
B)  attachment scanning timeout 
C)  actions for unscannable messages due to attachment type 
D)  minimum depth of attachment recursion to scan

Question 2

Users have been complaining of a higher volume of emails containing profanity. The network administrator will need to leverage dictionaries and create specific conditions to reduce the number of inappropriate emails. Which two filters should be configured to address this? (Choose two.)

Accepted Answer

A)  message 
B)  spam 
C)  VOF 
D)  sender group 
E)  content 
A)  message 
B)  spam 
C)  VOF 
D)  sender group 
E)  content

Question 3

Which benefit does enabling external spam quarantine on Cisco SMA provide?

Accepted Answer

A)  ability to back up spam quarantine from multiple Cisco ESAs to one central console 
B)  access to the spam quarantine interface on which a user can release, duplicate, or delete 
C)  ability to scan messages by using two engines to increase a catch rate 
D)  ability to consolidate spam quarantine data from multiple Cisco ESA to one central console 
A)  ability to back up spam quarantine from multiple Cisco ESAs to one central console 
B)  access to the spam quarantine interface on which a user can release, duplicate, or delete 
C)  ability to scan messages by using two engines to increase a catch rate 
D)  ability to consolidate spam quarantine data from multiple Cisco ESA to one central console

Question 4

Which type of query must be configured when setting up the Spam Quarantine while merging notifications?

Accepted Answer

A)  Spam Quarantine Alias Routing Query 
B)  Spam Quarantine Alias Consolidation Query 
C)  Spam Quarantine Alias Authentication Query 
D)  Spam Quarantine Alias Masquerading Query 
A)  Spam Quarantine Alias Routing Query 
B)  Spam Quarantine Alias Consolidation Query 
C)  Spam Quarantine Alias Authentication Query 
D)  Spam Quarantine Alias Masquerading Query

Question 5

Which method enables an engineer to deliver a flagged message to a specific virtual gateway address in the most flexible way?

Accepted Answer

A)  Set up the interface group with the flag. 
B)  Issue the altsrchost command. Issue the altsrchost command. 
C)  Map the envelope sender address to the host. 
D)  Apply a filter on the message. 
A)  Set up the interface group with the flag. 
B)  Issue the altsrchost command. Issue the altsrchost command. 
C)  Map the envelope sender address to the host. 
D)  Apply a filter on the message.

Question 6

An administrator is managing multiple Cisco ESA devices and wants to view the quarantine emails from all devices in a central location. How is this accomplished?

Accepted Answer

A)  Disable the VOF feature before sending SPAM to the external quarantine. 
B)  Configure a mail policy to determine whether the message is sent to the local or external quarantine. 
C)  Disable the local quarantine before sending SPAM to the external quarantine. 
D)  Configure a user policy to determine whether the message is sent to the local or external quarantine. 
A)  Disable the VOF feature before sending SPAM to the external quarantine. 
B)  Configure a mail policy to determine whether the message is sent to the local or external quarantine. 
C)  Disable the local quarantine before sending SPAM to the external quarantine. 
D)  Configure a user policy to determine whether the message is sent to the local or external quarantine.

Question 7

A Cisco ESA administrator was notified that a user was not receiving emails from a specific domain. After reviewing the mail logs, the sender had a negative sender-based reputation score. What should the administrator do to allow inbound email from that specific domain?

Accepted Answer

A)  Create a new inbound mail policy with a message filter that overrides Talos. 
B)  Ask the user to add the sender to the email application's allow list. 
C)  Modify the firewall to allow emails from the domain. 
D)  Add the domain into the allow list. 
A)  Create a new inbound mail policy with a message filter that overrides Talos. 
B)  Ask the user to add the sender to the email application's allow list. 
C)  Modify the firewall to allow emails from the domain. 
D)  Add the domain into the allow list.

Question 8

What is the default port to deliver emails from the Cisco ESA to the Cisco SMA using the centralized Spam Quarantine?

Accepted Answer

A)  8025 
B)  6443 
C)  6025 
D)  8443 
A)  8025 
B)  6443 
C)  6025 
D)  8443

Question 9

Refer to the exhibit. What is the correct order of commands to set filter 2 to active?

Accepted Answer

A)  filters-> edit-> 2-> Active 
B)  filters-> modify-> All-> Active 
C)  filters-> detail-> 2-> 1 
D)  filters-> set-> 2-> 1 
A)  filters-> edit-> 2-> Active 
B)  filters-> modify-> All-> Active 
C)  filters-> detail-> 2-> 1 
D)  filters-> set-> 2-> 1

Question 10

What occurs when configuring separate incoming mail policies?

Accepted Answer

A)  message splintering 
B)  message exceptions 
C)  message detachment 
D)  message aggregation 
A)  message splintering 
B)  message exceptions 
C)  message detachment 
D)  message aggregation

Question 11

Refer to the exhibit. How should this configuration be modified to stop delivering Zero Day malware attacks?

Accepted Answer

A)  Change Unscannable Action from Deliver As Is to Quarantine. 
B)  Change File Analysis Pending action from Deliver As Is to Quarantine. 
C)  Configure mailbox auto-remediation. 
D)  Apply Prepend on Modify Message Subject under Malware Attachments. 
A)  Change Unscannable Action from Deliver As Is to Quarantine. 
B)  Change File Analysis Pending action from Deliver As Is to Quarantine. 
C)  Configure mailbox auto-remediation. 
D)  Apply Prepend on Modify Message Subject under Malware Attachments.

Question 12

Which two certificate authority lists are available in Cisco ESA? (Choose two.)

Accepted Answer

A)  default 
B)  system 
C)  user 
D)  custom 
E)  demo 
A)  default 
B)  system 
C)  user 
D)  custom 
E)  demo

Question 13

An administrator identifies that, over the past week, the Cisco ESA is receiving many emails from certain senders and domains which are being consistently quarantined. The administrator wants to ensure that these senders and domain are unable to send anymore emails. Which feature on Cisco ESA should be used to achieve this?

Accepted Answer

A)  incoming mail policies 
B)  safelist 
C)  blocklist 
D)  S/MIME Sending Profile 
A)  incoming mail policies 
B)  safelist 
C)  blocklist 
D)  S/MIME Sending Profile

Question 14

A Cisco ESA administrator has noticed that new messages being sent to the Centralized Policy Quarantine are being released after one hour. Previously, they were being held for a day before being released. What was configured that caused this to occur?

Accepted Answer

A)  The retention period was changed to one hour. 
B)  The threshold settings were set to override the clock settings. 
C)  The retention period was set to default. 
D)  The threshold settings were set to default. 
A)  The retention period was changed to one hour. 
B)  The threshold settings were set to override the clock settings. 
C)  The retention period was set to default. 
D)  The threshold settings were set to default.

Question 15

Which component must be added to the content filter to trigger on failed SPF Verification or DKIM Authentication verdicts?

Accepted Answer

A)  status 
B)  response 
C)  parameter 
D)  condition 
A)  status 
B)  response 
C)  parameter 
D)  condition

Question 16

Which two steps configure Forged Email Detection? (Choose two.)

Accepted Answer

A)  Configure a content dictionary with executive email addresses. 
B)  Configure a filter to use the Forged Email Detection rule and dictionary. 
C)  Configure a filter to check the Header From value against the Forged Email Detection dictionary. 
D)  Enable Forged Email Detection on the Security Services page. 
E)  Configure a content dictionary with friendly names. 
A)  Configure a content dictionary with executive email addresses. 
B)  Configure a filter to use the Forged Email Detection rule and dictionary. 
C)  Configure a filter to check the Header From value against the Forged Email Detection dictionary. 
D)  Enable Forged Email Detection on the Security Services page. 
E)  Configure a content dictionary with friendly names.

Question 17

Which two configurations are used on multiple LDAP servers to connect with Cisco ESA? (Choose two.)

Accepted Answer

A)  load balancing 
B)  SLA monitor 
C)  active-standby 
D)  failover 
E)  active-active 
A)  load balancing 
B)  SLA monitor 
C)  active-standby 
D)  failover 
E)  active-active

Question 18

When URL logging is configured on a Cisco ESA, which feature must be enabled first?

Accepted Answer

A)  antivirus 
B)  antispam 
C)  virus outbreak filter 
D)  senderbase reputation filter 
A)  antivirus 
B)  antispam 
C)  virus outbreak filter 
D)  senderbase reputation filter

Question 19

What is the order of virus scanning when multilayer antivirus scanning is configured?

Accepted Answer

A)  The default engine scans for viruses first and the McAfee engine scans for viruses second. 
B)  The Sophos engine scans for viruses first and the McAfee engine scans for viruses second. 
C)  The McAfee engine scans for viruses first and the default engine scans for viruses second. 
D)  The McAfee engine scans for viruses first and the Sophos engine scans for viruses second. 
A)  The default engine scans for viruses first and the McAfee engine scans for viruses second. 
B)  The Sophos engine scans for viruses first and the McAfee engine scans for viruses second. 
C)  The McAfee engine scans for viruses first and the default engine scans for viruses second. 
D)  The McAfee engine scans for viruses first and the Sophos engine scans for viruses second.

Question 20

Which two statements about configuring message filters within the Cisco ESA are true? (Choose two.)

Accepted Answer

A)  The filters command executed from the CLI is used to configure the message filters. The filters command executed from the CLI is used to configure the message filters. 
B)  Message filters configuration within the web user interface is located within Incoming Content Filters . Message filters configuration within the web user interface is located within Incoming Content Filters . 
C)  The filterconfig command executed from the CLI is used to configure message filters. filterconfig command executed from the CLI is used to configure message filters. 
D)  Message filters can be configured only from the CLI. 
E)  Message filters can be configured only from the web user interface. 
A)  The filters command executed from the CLI is used to configure the message filters. The filters command executed from the CLI is used to configure the message filters. 
B)  Message filters configuration within the web user interface is located within Incoming Content Filters . Message filters configuration within the web user interface is located within Incoming Content Filters . 
C)  The filterconfig command executed from the CLI is used to configure message filters. filterconfig command executed from the CLI is used to configure message filters. 
D)  Message filters can be configured only from the CLI. 
E)  Message filters can be configured only from the web user interface.

Exam 25: Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Which global setting is configured under Cisco ESA Scan Behavior?

Users have been complaining of a higher volume of emails containing profanity. The network administrator will need to leverage dictionaries and create specific conditions to reduce the number of inappropriate emails. Which two filters should be configured to address this? (Choose two.)

Which benefit does enabling external spam quarantine on Cisco SMA provide?

Which type of query must be configured when setting up the Spam Quarantine while merging notifications?

Which method enables an engineer to deliver a flagged message to a specific virtual gateway address in the most flexible way?

An administrator is managing multiple Cisco ESA devices and wants to view the quarantine emails from all devices in a central location. How is this accomplished?

A Cisco ESA administrator was notified that a user was not receiving emails from a specific domain. After reviewing the mail logs, the sender had a negative sender-based reputation score. What should the administrator do to allow inbound email from that specific domain?

What is the default port to deliver emails from the Cisco ESA to the Cisco SMA using the centralized Spam Quarantine?

Refer to the exhibit. What is the correct order of commands to set filter 2 to active?

What occurs when configuring separate incoming mail policies?

Refer to the exhibit. How should this configuration be modified to stop delivering Zero Day malware attacks?

Which two certificate authority lists are available in Cisco ESA? (Choose two.)

A Cisco ESA administrator has noticed that new messages being sent to the Centralized Policy Quarantine are being released after one hour. Previously, they were being held for a day before being released. What was configured that caused this to occur?

Which component must be added to the content filter to trigger on failed SPF Verification or DKIM Authentication verdicts?

Which two steps configure Forged Email Detection? (Choose two.)

Which two configurations are used on multiple LDAP servers to connect with Cisco ESA? (Choose two.)

When URL logging is configured on a Cisco ESA, which feature must be enabled first?

What is the order of virus scanning when multilayer antivirus scanning is configured?

Which two statements about configuring message filters within the Cisco ESA are true? (Choose two.)

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters