Cisco CCNP 300-720 Questions & Answers

• Question 1:

  A network engineer is implementing a virus outbreak filter on a Cisco ESA by using the Outbreak Filters feature with plans to perform an additional scan by using a content filter. Which action must be taken by the Outbreak Filters?

  A. Scan processed messages by using two engines simultaneously.

  B. Send a copy of messages to quarantine.

  C. Send processed messages to the Cisco ESA.

  D. Scan processed messages by using a secondary instance of the Cisco ESA.

  Correct Answer: C

• Question 2:

  An organization wants to prevent proprietary patent documents from being shared externally via email. The network administrator reviewed the DLP policies on the Cisco ESA and could not find an existing policy with the appropriate matching patterns. Which type of DLP policy template must be used to create a policy that meets this requirement?

  A. regulatory compliance

  B. acceptable use

  C. custom policy

  D. privacy protection

  Correct Answer: D

• Question 3:

  An administrator notices that incoming emails with certain attachments do not get delivered to all recipients when the emails have multiple recipients in different domains like cisco.com and test.com. The same emails when sent only to recipients in cisco.com are delivered properly. How must the Cisco ESA be configured to avoid this behavior?

  A. Modify DLP configuration to ensure that all attachments are permitted for test.com.

  B. Modify DLP configuration to exempt DLP scanning for messages sent to test.com domain.

  C. Modify mail policies so email recipients do not match multiple policies.

  D. Modify mail policies for cisco.com to ensure that emails are not dropped.

  Correct Answer: B

• Question 4:

  Which content filter condition checks to see if the "From: header" in the message is similar to any of the users in the content dictionary?

  A. SPF Verification

  B. Duplicate Boundaries Verification

  C. Forged Email Detection

  D. Subject Header

  Correct Answer: C

• Question 5:

  An organization wants to use its existing Cisco ESA to host a new domain and enforce a separate corporate policy for that domain.

  What should be done on the Cisco ESA to achieve this?

  A. Use the smtproutes command to configure a SMTP route for the new domain.

  B. Use the deliveryconfig command to configure mail delivery for the new domain.

  C. Use the dsestconf command to add a separate destination for the new domain.

  D. Use the altrchost command to add a separate gateway for the new domain.

  Correct Answer: A

• Question 6:

  A network engineer must tighten up the SPAM control policy of an organization due to a recent SPAM attack. In which scenario does enabling regional scanning improve security for this organization?

  A. when most of the received email originates outside of the U.S.

  B. when most of the received email originates from a specific region

  C. when most of the received spam originates outside of the U.S.

  D. when most of the received spam comes from a specific country

  Correct Answer: D

• Question 7:

  A content dictionary was created for use with Forged Email Detection. Proper data that pertains to the CEO "Example CEO" must be entered. What must be added to the dictionary to accomplish this goal?

  A. ceo

  B. Example CEO

  C. [email protected]

  D. example.com

  Correct Answer: C

• Question 8:

  A Cisco ESA administrator recently enabled the Outbreak Filters Global Service Setting to detect Viral as well as Non-Viral threat detection, with no detection of Non-Viral threats after 24 hours of monitoring Outbreak Filters. What is the reason that Non-Viral threat detection is not detecting any positive verdicts?

  A. The Outbreak Filters option Graymail Header must be enabled.

  B. The Outbreak Filters option URL Rewriting must be enabled.

  C. Non-Viral threat detection requires AntiSpam or Intelligent Multi-Scan enablement to properly function.

  D. Non-Viral threat detection requires AntiVirus or AMP enablement to properly function.

  Correct Answer: C

• Question 9:

  A network administrator has enabled virus scanning with the Sophos antivirus engine and set the "drop infected mail" option on a Cisco ESA; however, end users are still complaining about the large number of phishing emails they receive. What must be done to resolve this problem?

  A. Configure Reputation Filtering

  B. Configure Content Filtering

  C. Configure Outbreak Filtering

  D. Change the antivirus engine to McAfee.

  Correct Answer: B

• Question 10:

  A network administrator enabled McAfee antivirus scanning on a Cisco ESA and configured the virus scanning action of "scan for viruses only." If the scanner finds a virus in an attachment for an incoming email, what action will be applied to this message?

  A. The attachment is dropped and replaced with a "Removed Attachment" file.

  B. The email and attachment are forwarded to the network administrator.

  C. The system will attempt to repair the attachment.

  D. No repair is attempted, and the attachment is either dropped or delivered.

  Correct Answer: D