Cisco CCNP Security 300-720 Questions & Answers

• Question 71:

  What is a benefit of enabling external SPAM quarantine on Cisco SMA?

  A. It provides access to the SPAM quarantine interface on which a user can release, duplicate, or delete.

  B. It provides the ability to scan messages by using two engines to increase a catch rate.

  C. It provides the ability to consolidate SPAM quarantine data from multiple Cisco ESAs to one central console.

  D. It provides the ability to back up SPAM quarantine from multiple Cisco ESAs to one central console.

  Correct Answer: C

• Question 72:

  A network administrator is modifying an outgoing mail policy to enable domain protection for the organization. A DNS entry is created that has the public key. Which two headers will be used as matching criteria in the outgoing mail policy? (Choose two.)

  A. message-ID

  B. sender

  C. URL reputation

  D. from

  E. mail-from

  Correct Answer: BD

• Question 73:

  To comply with a recent audit, an engineer must configure anti-virus message handling options on the incoming mail policies to attach warnings to the subject of an email. What should be configured to meet this requirement for known viral emails?

  A. Virus Infected Messages

  B. Unscannable Messages

  C. Encrypted Messages

  D. Positively Identified Messages

  Correct Answer: C

• Question 74:

  An administrator is managing multiple Cisco ESA devices and wants to view the quarantine emails from all devices in a central location. How is this accomplished?

  A. Disable the VOF feature before sending SPAM to the external quarantine.

  B. Configure a mail policy to determine whether the message is sent to the local or external quarantine.

  C. Disable the local quarantine before sending SPAM to the external quarantine.

  D. Configure a user policy to determine whether the message is sent to the local or external quarantine.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100000.html#task_1749146

• Question 75:

  A Cisco ESA administrator has several mail policies configured. While testing policy match using a specific sender, the email was not matching the expected policy.

  What is the reason of this?

  A. The "From" header is checked against all policies in a top-down fashion.

  B. The message header with the highest priority is checked against each policy in a top-down fashion.

  C. The "To" header is checked against all policies in a top-down fashion.

  D. The message header with the highest priority is checked against the Default policy in a top-down fashion.

  Correct Answer: D

• Question 76:

  An administrator identifies that, over the past week, the Cisco ESA is receiving many emails from certain senders and domains which are being consistently quarantined. The administrator wants to ensure that these senders and domain are unable to send anymore emails.

  Which feature on Cisco ESA should be used to achieve this?

  A. incoming mail policies

  B. safelist

  C. blocklist

  D. S/MIME Sending Profile

  Correct Answer: A

• Question 77:

  An engineer is testing mail flow on a new Cisco ESA and notices that messages for domain abc.com are stuck in the delivery queue. Upon further investigation, the engineer notices that the messages pending delivery are destined for 192.168.1.11, when they should instead be routed to 192.168.1.10.

  What configuration change needed to address this issue?

  A. Add an address list for domain abc.com.

  B. Modify Destination Controls entry for the domain abc.com.

  C. Modify the SMTP route for the domain and change the IP address to 192.168.1.10.

  D. Modify the Routing Tables and add a route for IP address to 192.168.1.10.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118136-qanda-esa-00.html

• Question 78:

  Refer to the exhibit. An engineer is trying to connect to a Cisco ESA using SSH and has been unsuccessful. Upon further inspection, the engineer notices that there is a loss of connectivity to the neighboring switch.

  

  Which connection method should be used to determine the configuration issue?

  A. Telnet

  B. HTTPS

  C. Ethernet

  D. serial

  Correct Answer: D

• Question 79:

  Refer to the exhibit.

  

  How should this configuration be modified to stop delivering Zero Day malware attacks?

  A. Change Unscannable Action from Deliver As Is to Quarantine.

  B. Change File Analysis Pending action from Deliver As Is to Quarantine.

  C. Configure mailbox auto-remediation.

  D. Apply Prepend on Modify Message Subject under Malware Attachments.

  Correct Answer: C

• Question 80:

  Which action on the Cisco ESA provides direct access to view the safelist/blocklist?

  A. Show the SLBL cache on the CLI.

  B. Monitor Incoming/Outgoing Listener.

  C. Export the SLBL to a .csv file.

  D. Debug the mail flow policy.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117922-technote-esa-00.html