Cisco CCNP Security 300-720 Questions & Answers

• Question 121:

  Which process is skipped when an email is received from safedomain.com, which is on the safelist?

  A. message filter

  B. antivirus scanning

  C. outbreak filter

  D. antispam scanning

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/214269-filter-to-handle-messages-that-skipped-d.html

• Question 122:

  An analyst creates a new content dictionary to use with Forged Email Detection. Which entry will be added into the dictionary?

  A. mycompany.com

  B. Alpha Beta

  C. ^Alpha\ Beta$

  D. [email protected]

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/whitepaper_C11-737596.html

• Question 123:

  Which suboption must be selected when LDAP is configured for Spam Quarantine End-User Authentication?

  A. Designate as the active query

  B. Update Frequency

  C. Server Priority

  D. Entity ID

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma11-5/user_guide/b_SMA_Admin_Guide_11_5/b_SMA_Admin_Guide_11_5_chapter_01010.html

• Question 124:

  Which action must be taken before a custom quarantine that is being used can be deleted?

  A. Delete the quarantine that is assigned to a filter.

  B. Delete the quarantine that is not assigned to a filter.

  C. Delete only the unused quarantine.

  D. Remove the quarantine from the message action of a filter.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011111.html

• Question 125:

  Which antispam feature is utilized to give end users control to allow emails that are spam to be delivered to their inbox, overriding any spam verdict and action on the Cisco ESA?

  A. end user allow list

  B. end user spam quarantine access

  C. end user passthrough list

  D. end user safelist

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_11-1/b_ESA_Admin_Guide_ces_11_1/b_ESA_Admin_Guide_chapter_011111.pdf

• Question 126:

  What are two prerequisites for implementing undesirable URL protection in Cisco ESA? (Choose two.)

  A. Enable outbreak filters.

  B. Enable email relay.

  C. Enable antispam scanning.

  D. Enable port bouncing.

  E. Enable antivirus scanning.

  Correct Answer: AC

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01111.html

• Question 127:

  Which setting affects the aggressiveness of spam detection?

  A. protection level

  B. spam threshold

  C. spam timeout

  D. maximum depth of recursion scan

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118220-technote-esa-00.html

• Question 128:

  What is the order of virus scanning when multilayer antivirus scanning is configured?

  A. The default engine scans for viruses first and the McAfee engine scans for viruses second.

  B. The Sophos engine scans for viruses first and the McAfee engine scans for viruses second.

  C. The McAfee engine scans for viruses first and the default engine scans for viruses second.

  D. The McAfee engine scans for viruses first and the Sophos engine scans for viruses second.

  Correct Answer: C

  If you configure multi-layer anti-virus scanning, the Cisco appliance performs virus scanning with the McAfee engine first and the Sophos engine second. It scans messages using both engines, unless the McAfee engine detects a virus. If the McAfee engine detects a virus, the Cisco appliance performs the anti-virus actions (repairing, quarantining, etc.) defined for the mail policy.

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01011.html

• Question 129:

  What are two phases of the Cisco ESA email pipeline? (Choose two.)

  A. reject

  B. workqueue

  C. action

  D. delivery

  E. quarantine

  Correct Answer: BD

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-1/user_guide/b_ESA_Admin_Guide_12_1/b_ESA_Admin_Guide_12_1_chapter_011.pdf (p.1)

• Question 130:

  Which two action types are performed by Cisco ESA message filters? (Choose two.)

  A. non-final actions

  B. filter actions

  C. discard actions

  D. final actions

  E. quarantine actions

  Correct Answer: AD

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.html