I85PREP
⌘ K
CCIE Security study materials
CCIE Security study resources

CCIE Security: Content Security

CCIE Security · Work through your exam, one topic at a time.

All guide sections

Content Security

What this domain tests

Content Security covers Cisco Secure Email and Secure Web Appliance plus Umbrella: mail authentication and policy, web proxy deployment, identity, TLS decryption, and acceptable-use controls. The exam favors operational reasoning about why a message is quarantined or a site is blocked.

Core rules

  • Email authentication: SPF checks the envelope sender against published IPs; DKIM signs selected headers and the body with a domain and selector; DMARC aligns SPF or DKIM with the header From domain and publishes policy.
  • DMARC alignment can be relaxed (organizational domain) or strict (exact domain); p=none monitors, p=quarantine filters, p=reject blocks.
  • ESA processing follows listener, host access table, mail policy, content filters, then quarantine or delivery.
  • WSA deployment is explicit proxy, transparent via WCCP or PBR, or PAC-file driven; identity comes from AD, NTLM, Kerberos, or SAML.
  • HTTPS inspection requires a certificate the client trusts; pinned applications and some categories should bypass decryption.

Worked example

example.com sends marketing through an ESP at 192.0.2.0/24 and corporate mail through its own MTA at 198.51.100.10. Spoofed mail using From: example.com is reaching customers, and DMARC is p=none.

Reasoning: publish an SPF record that includes the ESP and ip4:198.51.100.10, keeping DNS lookups under the SPF limit of 10. Have the ESP sign with d=example.com, selector s1, and the corporate MTA sign with s2. Move DMARC to p=quarantine with relaxed alignment so ESP subdomain return-paths still align. On inbound ESA, verify DMARC before content filters and quarantine failures. Do not jump to p=reject: mailing lists and forwarders break SPF, and aggregate reports must be reviewed first. pct=100 only after monitoring shows legitimate mail passes.

Traps that cost marks

  • SPF breaks on forwarding; DKIM usually survives it.
  • DMARC evaluates the header From domain, not the envelope sender.
  • p=none still generates aggregate reports and does not block.
  • Decrypting pinned traffic causes application failures.
  • Transparent proxy without WCCP or PBR silently bypasses policy.

Key points

  • SPF authenticates the envelope sender; DKIM signs content; DMARC aligns and enforces.
  • Keep SPF DNS lookups at or below 10.
  • Relaxed DMARC alignment compares organizational domains.
  • ESA policy order is listener, HAT, mail policy, content filter, action.
  • HTTPS inspection depends on trusted certificates and bypass policy.
  • WSA identity determines policy; unauthenticated users may fall into a default policy.