Securing Email with Cisco Email Security Appliance
Duration: 90 minutes
Languages: English
Associated certifications
CCNP Security
Cisco Certified Specialist - Email Content Security

Exam overview
This exam tests your knowledge of Cisco Email Security Appliance, including:

Administration
Spam control and antispam
Message filters
Data loss prevention
LDAP
Email authentication and encryption
System quarantines and delivery methods

Securing Email with Cisco Email Security Appliance v1.0 (300-720)
Exam Description: Securing Email with Cisco Email Security Appliance v1.0 (SESA 300-720) is a 90-minute exam associated with the CCNP Security Certification. This exam tests a candidate's knowledge of Cisco Email Security Appliance, including administration, spam control and antispam, message filters, data loss prevention, LDAP, email authentication and encryption, and system quarantines and delivery methods. The course, Securing Email with Cisco Email Security Appliance, helps candidates to prepare for this exam.

The following topics are general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. To better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

15% 1.0 Cisco Email Security Appliance Administration
1.1. Configure Cisco Email Security Appliance features
1.1.a Hardware performance specifications
1.1.b Initial configuration process
1.1.c Routing and delivery features
1.1.d GUI
1.2. Describe centralized services on a Cisco Content SMA
1.3. Configure mail policies
1.3.a. Incoming and outgoing messages
1.3.b. User matching
1.3.c. Message splintering

15% 2.0 Spam Control with Talos SenderBase and Antispam
2.1 Control spam with Talos SenderBase and Antispam
2.2 Describe graymail management solution
2.3 Configure file reputation filtering and file analysis features
2.4 Implement malicious or undesirable URLs protection
2.5 Describe the bounce verification feature

20% 3.0 Content and Message filters
3.1 Describe the functions and capabilities of content filters
3.2 Create text resources such as content dictionaries, disclaimers, and templates
3.2.a Dictionaries filter rules
3.2.b Text resources management
3.3 Configure message filters components, rules, processing order and attachment scanning
3.4 Configure scan behavior
3.5 Configure the Cisco ESA to scan for viruses using Sophos and McAfee scanning engines
3.6 Configure outbreak filters
3.7 Configure Data Loss Prevention (DLP)

15% 4.0 LDAP and SMTP Sessions
4.1 Configure and verify LDAP servers and queries (Queries and Directory Harvest Attack)
4.2 Understand spam quarantine functions
4.2.a Authentication for end-users of spam quarantine
4.2.b Utilize spam quarantine alias to consolidate queries
4.3 Understand SMTP functionality
4.3.a Email pipeline
4.3.b Sender and recipient domains
4.3.c SMTP session authentication using client certificates
4.3.d SMTP TLS authentication
4.3.e TLS email encryption

20% 5.0 Email Authentication and Encryption
5.1 Configure Domain Keys and DKIM signing
5.2 Configure SPF and SIDF
5.3 Configure DMARC verification
5.4 Configure forged email detection
5.5 Configure email encryption
5.6 Describe S/MIME security services and communication encryption with other MTAs
5.7 Manage certificate authorities

15% 6.0 System Quarantines and Delivery Methods
6.1 Configure quarantine (spam, policy, virus, and outbreak)
6.2 Utilize safelists and blocklists to control email delivery
6.3 Manage messages in local or external spam quarantines
6.4 Configure virtual gateways

QUESTION 1
Which SMTP extension does Cisco ESA support for email security?

A. ETRN
B. UTF8SMTP
C. PIPELINING
D. STARTTLS

Answer: D

QUESTION 2
Which feature utilizes sensor information obtained from Talos intelligence to filter email servers connecting into the Cisco ESA?

A. SenderBase Reputation Filtering
B. Connection Reputation Filtering
C. Talos Reputation Filtering
D. SpamCop Reputation Filtering

Answer: A

QUESTION 3
When the Spam Quarantine is configured on the Cisco ESA, what validates end-users via LDAP duringlogin to the End-User Quarantine?

A. Enabling the End-User Safelist/Blocklist feature
B. Spam Quarantine External Authentication Query
C. Spam Quarantine End-User Authentication Query
D. Spam Quarantine Alias Consolidation Query

Answer: C

QUESTION 4
Which benefit does enabling external spam quarantine on Cisco SMA provide?

A. ability to back up spam quarantine from multiple Cisco ESAs to one central console
B. access to the spam quarantine interface on which a user can release, duplicate, or delete
C. ability to scan messages by using two engines to increase a catch rate
D. ability to consolidate spam quarantine data from multiple Cisco ESA to one central console

Answer: D

QUESTION 5
When email authentication is configured on Cisco ESA, which two key types should be selected on the signing profile? (Choose two.)

A. DKIM
B. Public Keys
C. Domain Keys
D. Symmetric Keys
E. Private Keys

Answer: AC

QUESTION 6
What are two phases of the Cisco ESA email pipeline? (Choose two.)

A. reject
B. workqueue
C. action
D. delivery
E. quarantine

Answer: BD