Cisco 300-720 SESA flashcards
Cisco 300-720 SESA · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- AsyncOS
- The operating system running on Cisco Email Security Appliances. It provides CLI and web GUI management, the commit model, logging, and all mail processing features.
- Listener
- A listener binds an interface and port to a mail flow policy. It defines how the ESA accepts inbound SMTP connections and which policies apply to them.
- Commit Changes
- GUI changes stage in memory until committed. Uncommitted changes are lost on reboot. The CLI requires the commit command after configuration edits.
- Cluster and Group
- A cluster is a set of ESA appliances sharing configuration. Groups within a cluster share settings; machine-specific settings override cluster and group settings.
- saveconfig and loadconfig
- CLI commands that back up and restore the appliance configuration. Backups are version-specific and may fail to load on a different AsyncOS major version.
- Feature Keys
- Per-appliance licenses tied to the serial number. They enable features such as IronPort Anti-Spam, Sophos Anti-Virus, DLP, and Outbreak Filters.
- Log Subscription
- A configuration that forwards a log file (e.g., mail_logs) to syslog, a file, or FTP. Created with logconfig and viewed with tail or grep.
- High Availability Pair
- Two ESAs with a shared IP that fail over to each other. Requires matching AsyncOS versions and listener configurations for a seamless failover.
- SPF
- Sender Policy Framework. The sending domain publishes a TXT record of authorized sending IPs. The ESA validates inbound SPF if enabled in the mail flow policy.
- DKIM Signing
- The ESA signs outbound mail with a private key. The matching public key is published as a DNS TXT record at selector._domainkey.domain.
- DKIM Verification
- Inbound messages are verified against the sender's published DKIM key. The result (dkim=pass or fail) appears in the Authentication-Results header.
- DMARC
- A DNS policy at _dmarc.domain telling receivers what to do when SPF and DKIM both fail. Alignment with the From domain is required for a pass.
- Authentication-Results Header
- A header added by the ESA recording SPF, DKIM, and DMARC results. Content filters can match on these results to take action.
- Opportunistic TLS
- The ESA attempts TLS with the destination and falls back to cleartext if negotiation fails. Configured per destination domain under Destination Controls.
- Required TLS
- The ESA rejects the connection if TLS cannot be negotiated with the destination. Configured per destination domain under Destination Controls.
- CRES Encryption
- Cisco Secure Email Encryption. It provides message-level encryption using a hosted key service, independent of transport TLS.
- IronPort Anti-Spam
- Assigns a spam score to each message. Thresholds are set per mail flow policy; SUSPECT messages can be quarantined and POSITIVE messages dropped or tagged.
- Outbreak Filters
- Uses Cisco Talos threat data to catch zero-day and targeted attacks before signatures exist. Suspicious messages are held in an Outbreak quarantine.
- Sophos Anti-Virus
- Scans attachments and message bodies for viruses. Infected messages can be dropped, quarantined, or cleaned, configured per mail flow policy.
- Reputation Filtering
- Scores the sending IP using SenderBase. A low reputation can throttle or reject connections at the listener based on the mail flow policy.
- Grapevine
- Shares reputation and host data across appliances or a cluster. Managed with the grapevineconfig CLI command.
- Quarantine Types
- Spam, Virus, Outbreak, Policy, and Message quarantines. Each has its own retention and release rules, managed with quarantineconfig.
- Content Filters
- Match on message attributes such as subject, body, attachment, sender, or recipient, then apply actions like drop, quarantine, add-header, notify, or BCC.
- Message Filters
- CLI-created filters using the filters command. They use a different syntax than GUI content filters and support actions like drop, bounce, and notify.
- Mail Flow Policy
- Applies per listener and sender/receiver group. It controls TLS, SPF, anti-spam, anti-virus, and connection limits. The default policy applies when nothing else matches.
- DLP Classifiers
- Patterns used by DLP policies. Predefined classifiers cover credit cards and SSNs; custom classifiers use regex or content match.
- DLP Policy Order
- The first matching DLP policy with the highest severity wins. Policy order determines which action (quarantine, drop, encrypt) is applied.
- Policy Quarantine
- Holds messages matched by a DLP or content filter for admin review. Release requires an admin action; retention is configurable.
- smtproutes
- CLI command that routes mail for a domain to a specific host. The default route handles all other domains. Useful for hybrid Exchange or O365 deployments.
- LDAP Integration
- Configures an LDAP profile for recipient validation, SMTP AUTH, and directory-based policies. Managed with ldapconfig under System Administration.
- Message Tracking
- Records message events such as received, delivered, and bounced. Search by sender, recipient, or message ID in the GUI under Message Tracking.
- hoststatus
- CLI command that shows destination reachability, DNS resolution, and queue state. Used to diagnose mail stuck in the queue.