Cisco CCNP 300-720 Questions & Answers

• Question 121:

  Which restriction is in place for end users accessing the spam quarantine on Cisco ESA devices?

  A. The end user must be assigned to the Guest role.

  B. Access via a link in a notification in mandatory.

  C. Authentication is required when accessing via a link in a notification.

  D. Direct access via web browser requires authentication.

  Correct Answer: A

• Question 122:

  An organization has strict rules for meeting specific criteria to approve certificate authorities. A Cisco ESA administrator within the organization is receiving complaints about failed inbound emails from a domain. The administrator is also seeing TLS certificate errors. What is the reason for this issue?

  A. Firewall inspection is preventing transmission of certificate data.

  B. The certificate authority is not on the system list.

  C. The TLSv1.0 protocol is not supported.

  D. The certificate chain is broken.

  Correct Answer: D

• Question 123:

  An organization wants to designate help desk personnel to assist with tickets that request the release of messages from the spam quarantine because company policy does not permit end-user quarantine access to employees directly. Which two roles must be used for these personnel to release messages while restricting access to make configuration changes in the Cisco ESA? (Choose two.)

  A. Administrator

  B. Read-Only Operator

  C. Technician

  D. Quarantine Administrator

  E. Help Desk User

  Correct Answer: DE

• Question 124:

  A Cisco ESA is configured such that emails with a reputation score above -6 are logged and those with a score below -6 are logged, encrypted, and then delivered. An email body contains a shortened URL that exceeds the nested shortened URLs limit. Which action is taken against the email?

  A. It is encrypted but not logged.

  B. It is logged but not encrypted.

  C. It is logged and dropped.

  D. It is logged and encrypted.

  Correct Answer: A

• Question 125:

  An administrator needs to configure a Cisco ESA to verify that a specific mail server is authorized to send emails for a domain. To reduce overhead, the administrator does not want SSL type encryption or decryption to be used in this process. What must be configured on the Cisco ESA to meet this requirement?

  A. DomainKeys Identified Mail

  B. PKI signing keys

  C. Asymmetric keys

  D. Sender Policy Framework

  Correct Answer: D

• Question 126:

  A network engineer is editing the default DMARC verification profile on a Cisco ESA and must ensure that the configured Message Action in the profile matches the policy in the DMARC record. What must be set to achieve this result?

  A. "Message Action when the Policy in DMARC Record is Reject" to Reject

  B. "Message Action when the Policy in DMARC Record is None" to Quarantine

  C. "Message Action when the Policy in DMARC Record is None" to No Action

  D. "Message Action when the Policy in DMARC Record is Reject" to Quarantine

  Correct Answer: A

• Question 127:

  A remote financial institution is implementing email encryption. It is required that all inbound emails use SMTP over TLS. What must be done to accomplish this?

  A. Disable TLS certificates.

  B. Utilize Cisco Registered Envelope Service.

  C. Leverage Cisco Talos Threat Intelligence Group.

  D. Enable Application Inspection and Control for SMTP.

  Correct Answer: D

• Question 128:

  What is the purpose of checking the CRL during SMTP authentication on a Cisco ESA?

  A. Check if the certificate is not revoked.

  B. Confirm that corresponding CA is present.

  C. Verify the common name matches user ID.

  D. Validate the date to check if the certificate is still valid.

  Correct Answer: A

• Question 129:

  A company security policy requires that the finance department have an easy way to apply encryption to their outbound messages that contain sensitive data. Users must be able to flag the messages that require encryption versus a Cisco ESA scanning all messages and automatically encrypting via detection. Which action enables this capability?

  A. Create an outgoing content filter with no conditions and with the Encrypt and Deliver Now action configured with [SECURE] in the Subject setting.

  B. Create a DLP policy manager message action with encryption enabled and apply it to active DLP policies for outgoing mail.

  C. Create an encryption profile with [SECURE] in the Subject setting and enable encryption on the mail flow policy.

  D. Create an encryption profile and an outgoing content filter that includes \[SECURE\] within the Subject Header: Contains condition along with the Encrypt and Deliver Now action.

  Correct Answer: D

• Question 130:

  An engineer is reviewing the SMTP routing table on a Cisco ESA using the smtproutes CLI command and discovers an IPv6 route for 2620:104:4360:9232::23. What type of IPv6 route does this represent?

  A. Network route

  B. Subnet route

  C. Device route

  D. Prefix route

  Correct Answer: C