Cisco CCNP 300-720 Questions & Answers

• Question 11:

  An engineer is tasked with creating a content filter to catch attachments, including credit card numbers, and hold them for review until further action is taken. Which component on a Cisco ESA must be configured to meet this requirement?

  A. Spam Quarantine

  B. Outbreak Filter

  C. Policy Quarantine

  D. Content Filter

  Correct Answer: D

• Question 12:

  A list of company executives is routinely being spoofed, which puts the company at risk of malicious email attacks. An administrator must ensure that executive messages are originating from legitimate sending addresses. Which two steps must be taken to accomplish this task? (Choose two.)

  A. Create an incoming content filter with SPF detection.

  B. Create a content dictionary including a list of the names that are being spoofed.

  C. Enable the Forged Email Detection feature under Security Settings.

  D. Enable DMARC feature under Mail Policies.

  E. Create an incoming content filter with the Forged Email Detection condition.

  Correct Answer: AD

• Question 13:

  An engineer tries to implement phishing simulations to test end users, but they are being blocked by the Cisco ESA. Which two components, when added to the allow list, allow these simulations to bypass antispam scanning? (Choose two.)

  A. receivers

  B. domains

  C. reputation score

  D. spf check

  E. senders

  Correct Answer: CE

• Question 14:

  What is a benefit of deploying Cisco SMA?

  A. centralized management of logs for Cisco ESA appliances

  B. centralized management of botnet directories

  C. centralized management of software updates for Cisco ESA appliances

  D. centralized management of quarantined email

  Correct Answer: C

• Question 15:

  Which feature must be activated on a Cisco ESA to combat backscatter?

  A. Graymail Detection

  B. Bounce Profile

  C. Forged Email Detection

  D. Bounce Verification

  Correct Answer: D

• Question 16:

  What must be considered when viewing spam messages addressed to an email alias on Cisco ESA?

  A. It is only possible via a link in a notification.

  B. It is only possible via a web browser directly.

  C. The access is granted via any method.

  D. It is impossible via mailbox authentication.

  Correct Answer: A

• Question 17:

  Spammers routinely try to send emails with the recipient field filled with a list of all possible combinations of letters and numbers. These combinations, appended with a company's domain name are malicious attempts at learning all possible valid email addresses. Which action must be taken on a Cisco ESA to prevent this from occurring?

  A. Quarantine external authentication queries.

  B. Enable end user safelist features.

  C. Perform LDAP acceptance validation.

  D. Select the SMTP Authentication Query checkbox.

  Correct Answer: C

• Question 18:

  An organization has a strict policy on URLs embedded in emails. The policy allows visibility into what the URL is but does not allow the user to click it. Which action must be taken to meet the requirements of the security policy?

  A. Defang the URL.

  B. Enable the URL quarantine policy.

  C. Replace the URL with text.

  D. Redirect the URL to the Cisco security proxy.

  Correct Answer: D

• Question 19:

  What is a category for classifying graymail?

  A. Priority

  B. Marketing

  C. Malicious

  D. Spam

  Correct Answer: B

• Question 20:

  Refer to the exhibit.

  

  A network engineer must set up a content filter to find any messages that failed SPF and send them into quarantine. The content filter has been set up and enabled, but all messages except those that have failed SPF are being sent into quarantine. Which section of the filter must be modified to correct this behavior?

  A. log-entry

  B. quarantine

  C. spf-status

  D. skip-filters

  Correct Answer: C