I85PREP
⌘ K
Cisco 300-720 SESA study materials
Cisco 300-720 SESA study resources

Cisco 300-720 SESA practice questions

One question at a time. Build your Cisco 300-720 SESA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Email Security Appliance Deployment and Administration

Which Cisco Email Security Appliance listener setting determines whether SMTP sessions are accepted on port 25 and whether TLS is offered to connecting hosts?

  1. The default destination queue for the listener
  2. The listener's interface, port, and TLS configuration Correct answer.
  3. The HAT (Host Access Table) entry for the connecting host
  4. The global SMTP banner and HELO verification settings

Explanation

A listener binds a service to a specific interface and port and carries its own TLS settings, so it controls whether SMTP is accepted on port 25 and whether STARTTLS is advertised. The HAT then decides which senders are allowed or rejected once the session reaches that listener.

Question 2Email Security Appliance Deployment and Administration

An administrator wants messages from a trusted partner relay to bypass anti-spam scanning while still being scanned by antivirus. Which configuration achieves this?

  1. Add the partner to a sender group with a mail flow policy that enables antivirus and disables anti-spam Correct answer.
  2. Place the partner IP in the blocklist of the default sender group
  3. Create a content filter that quarantines all mail from the partner domain
  4. Disable the anti-spam engine globally on the appliance

Explanation

Mail flow policies attached to sender groups control which scanning engines run for matching senders, so a policy with anti-spam disabled and antivirus enabled gives exactly the requested behavior. This keeps protection granular without affecting other senders.

Question 3Email Security Appliance Deployment and Administration

What is the function of the HAT (Host Access Table) on a Cisco Email Security Appliance?

  1. It defines the order in which content filters are evaluated
  2. It maps connecting hosts to sender groups and their mail flow policies Correct answer.
  3. It maps recipient addresses to destination queues
  4. It stores TLS certificates presented to sending MTA

Explanation

The HAT is consulted at connection time and uses senderbase reputation or explicit entries to place a connecting host into a sender group. Each sender group references a mail flow policy that governs acceptance and scanning for that host.

Question 4Email Security Appliance Deployment and Administration

A company needs all inbound mail for example.com to be accepted only for known recipients and rejected otherwise at SMTP time. Which feature should be configured?

  1. The Recipient Access Table (RAT) with the domain set to accept only listed recipients Correct answer.
  2. A content filter that bounces unknown recipients after acceptance
  3. An outbound SMTP authentication profile
  4. The HAT with the domain added to the blocklist

Explanation

The RAT controls which recipients the appliance accepts during the SMTP conversation, so unknown recipients can be rejected before the message body is transferred. This reduces backscatter and resource use compared with accepting and then bouncing.

Question 5Email Security Appliance Deployment and Administration

Which statement best describes the role of message filters compared with content filters on the appliance?

  1. Message filters require the message body to be fully received before they run
  2. Message filters act on envelope and connection data and can drop or redirect before full message acceptance Correct answer.
  3. Content filters operate only on the SMTP envelope and cannot inspect body content
  4. Content filters can only be applied to outbound mail

Explanation

Message filters run early and can act on envelope information such as sender, recipient, and connection details, allowing actions like drop or redirect before the full message is accepted. Content filters typically evaluate the complete message, including headers and body.

Question 6Email Security Appliance Deployment and Administration

An administrator configures LDAP recipient acceptance so the appliance queries an external directory. What happens when the LDAP server is unreachable?

  1. The appliance accepts all recipients and defers validation
  2. The appliance converts the recipient lookup into a content filter match
  3. The appliance uses the configured fallback behavior, which may accept or reject depending on the setting Correct answer.
  4. The appliance automatically disables the listener

Explanation

LDAP acceptance queries include a configurable action for when the directory cannot be reached, allowing the administrator to choose acceptance or rejection as a fail-open or fail-closed posture. This prevents an outage from silently changing policy unless intended.

Question 7Email Security Appliance Deployment and Administration

Which configuration is required to enable SMTP authentication for outbound relay through the appliance?

  1. A HAT entry that blocklists all internal hosts
  2. A content filter that adds an X-Authenticated header
  3. A listener with the SMTP authentication profile enabled and a matching user or LDAP source Correct answer.
  4. A destination control that limits concurrent connections

Explanation

Outbound SMTP authentication requires the listener to reference an SMTP authentication profile and a user source such as LDAP, allowing clients to authenticate before relaying. The profile links the listener to the credential store.

Question 8Email Security Appliance Deployment and Administration

What is the purpose of a Virtual Gateway on a Cisco Email Security Appliance?

  1. To provide separate SMTP receiving IP addresses with independent listeners and settings Correct answer.
  2. To provide a secondary management interface for cluster communication
  3. To create a VPN tunnel to a remote mail server
  4. To virtualize the appliance's storage for message tracking

Explanation

Virtual gateways allow a single appliance to present multiple IP addresses for SMTP, each with its own listeners, certificates, and configuration. This supports hosting multiple domains or customers with distinct receiving identities.

Question 9Email Security Appliance Deployment and Administration

An administrator needs to ensure that outbound mail from internal users is only accepted when the sender address belongs to a known domain. Which feature enforces this?

  1. TLS required on the inbound listener
  2. Inbound content filter that rewrites the From header
  3. Outbound sender domain validation (LDAP or static) on the outbound listener Correct answer.
  4. Senderbase reputation filtering

Explanation

Outbound sender validation checks that the envelope sender belongs to a permitted domain before the appliance relays the message. This prevents internal hosts from sending mail with forged or unauthorized sender domains.

Question 10Email Security Appliance Deployment and Administration

Which action in a content filter would you use to add a disclaimer to the bottom of every outbound message?

  1. Quarantine the message
  2. Add a message footer using the add-footer action Correct answer.
  3. Drop the message
  4. Redirect the message to an alternate recipient

Explanation

The add-footer action appends configured text to the message body, which is the standard way to apply disclaimers. Other actions change delivery rather than modifying content.

Question 11Email Security Appliance Deployment and Administration

Which DNS record type does the appliance use to look up the reputation of a connecting host when Senderbase/ Talos reputation filtering is enabled?

  1. TXT record containing SPF policy
  2. Senderbase query over DNS using a reputation score lookup Correct answer.
  3. PTR record for HELO verification
  4. MX record lookup of the sender domain

Explanation

Reputation filtering queries the Senderbase service, typically via DNS, to obtain a reputation score for the connecting IP address. The score is then used to classify the sender into good, neutral, or poor groups.

Question 12Email Security Appliance Deployment and Administration

What does the SBRS (SenderBase Reputation Score) range of -10 to 10 represent on the appliance?

  1. A score representing the number of messages received per hour
  2. A score representing the TLS cipher strength of the connection
  3. A score where higher values indicate more spam confidence
  4. A score where negative values indicate poor reputation and positive values indicate good reputation Correct answer.

Explanation

SBRS ranges from -10 to 10, with negative values indicating poor reputation and positive values indicating good reputation. The appliance uses these scores to place senders into reputation-based sender groups.

Question 13Email Security Appliance Deployment and Administration

An administrator wants to quarantine messages that fail DMARC for a specific domain and notify the sender. Which combination of features is most appropriate?

  1. A virtual gateway dedicated to the domain
  2. A HAT blocklist entry for the domain
  3. A destination control limiting connections
  4. A content filter with a quarantine action plus a notification action Correct answer.

Explanation

DMARC verification results are exposed to content filters, which can quarantine failing messages and send notifications. Combining quarantine with notification gives the requested behavior.

Question 14Email Security Appliance Deployment and Administration

Which feature allows the appliance to verify that the sending MTA's HELO name resolves to the connecting IP address?

  1. DKIM signature validation
  2. DMARC alignment checking
  3. SPF verification
  4. HELO verification with forward-confirmed reverse DNS Correct answer.

Explanation

HELO verification performs a forward-confirmed reverse DNS check to confirm that the HELO name resolves to the connecting IP. This is a separate mechanism from SPF, DKIM, and DMARC.

Question 15Email Security Appliance Deployment and Administration

A mail administrator wants to prevent internal users from sending messages with attachments larger than 20 MB. Which configuration is most appropriate?

  1. A listener with a smaller maximum message size
  2. A content filter with a maximum message size condition and a drop action Correct answer.
  3. A destination control limiting concurrent connections
  4. An LDAP acceptance query on the outbound listener

Explanation

A content filter can match messages exceeding a specified size and apply a drop or bounce action, giving granular control per policy. This targets the attachment/size requirement directly.

Question 16Email Security Appliance Deployment and Administration

What is the role of the Cisco Email Security Appliance cluster configuration?

  1. To synchronize configuration and enable centralized management across multiple appliances Correct answer.
  2. To distribute DNS lookups across appliances
  3. To encrypt SMTP traffic between the appliance and external hosts
  4. To provide high availability of the management interface only

Explanation

Clustering allows multiple appliances to share configuration and be managed centrally, keeping settings consistent across the group. It also supports machine-level grouping for scalability.

Question 17Email Security Appliance Deployment and Administration

Which listener setting controls whether the appliance accepts messages for relay from hosts not in the RAT?

  1. The mail flow policy associated with the sender group of the connecting host Correct answer.
  2. The default destination queue
  3. The TLS certificate assigned to the listener
  4. The SMTP banner text

Explanation

The mail flow policy attached to the sender group determines whether relay is allowed for a given host and connection. Hosts are grouped via the HAT and then governed by the policy.

Question 18Email Security Appliance Deployment and Administration

Which statement about the appliance's message tracking feature is correct?

  1. It only tracks messages that fail anti-spam scanning
  2. It records message events such as receipt, delivery, and bounce for later querying Correct answer.
  3. It replaces the need for content filters
  4. It stores full message bodies indefinitely for compliance

Explanation

Message tracking logs events across the message lifecycle, allowing administrators to search for a message's status. It does not retain full message bodies indefinitely.

Question 19Email Security Appliance Deployment and Administration

An administrator needs to route outbound mail through a smart host based on the recipient domain. Which configuration is used?

  1. A destination or routing configuration that maps domains to the smart host Correct answer.
  2. A content filter with a drop action
  3. A HAT entry that blocklists the recipient domain
  4. A virtual gateway assigned to the recipient domain

Explanation

Routing and destination settings can direct messages for specific domains to a configured smart host. This is separate from HAT and content filter actions.

Question 20Email Security Appliance Deployment and Administration

Which anti-spam verdict categories are typically available for messages processed by the appliance?

  1. Only quarantined and delivered
  2. Only spam and ham
  3. Only virus and clean
  4. Spam, suspected spam, marketing mail, and ham Correct answer.

Explanation

The appliance classifies messages into categories such as spam, suspected spam, marketing mail, and ham, each of which can be mapped to actions. This allows differentiated treatment of borderline messages.

Question 21Email Security Appliance Deployment and Administration

Which feature allows the appliance to detect and block messages containing known malicious URLs?

  1. URL filtering or outbreak intelligence using reputation feeds Correct answer.
  2. SPF verification
  3. DKIM signing
  4. HELO verification

Explanation

URL filtering and outbreak intelligence services evaluate links in messages against reputation feeds to block malicious URLs. The other options are authentication mechanisms.

Question 22Email Security Appliance Deployment and Administration

An administrator configures a content filter to apply only to messages from a specific sender domain. Which condition should be used?

  1. A condition matching the TLS cipher
  2. A condition matching the envelope sender or From header domain Correct answer.
  3. A condition matching the destination queue
  4. A condition matching the appliance hostname

Explanation

Content filter conditions can match sender addresses in the envelope or From header, allowing domain-scoped rules. This is the appropriate way to target a specific sender domain.

Question 23Email Security Appliance Deployment and Administration

Which statement describes the default behavior when a message triggers a content filter with a quarantine action?

  1. The message is returned to the sender with a 550 error
  2. The message is placed in the configured quarantine for administrator or user review Correct answer.
  3. The message is delivered with a warning header
  4. The message is silently dropped

Explanation

Quarantine holds the message in a designated store for review rather than delivering or discarding it. Administrators or end users can then release or delete it.

Question 24Email Security Appliance Deployment and Administration

An administrator wants to ensure that TLS is enforced for all inbound SMTP sessions from a specific partner. Which configuration is most appropriate?

  1. A mail flow policy that requires TLS for the partner's sender group Correct answer.
  2. A content filter that adds a header when TLS is absent
  3. An LDAP acceptance query for the partner domain
  4. A destination control limiting connections from the partner

Explanation

Mail flow policies include a TLS requirement setting that can enforce encryption for sessions from a sender group. This rejects non-TLS sessions from the partner when required.

Question 25Email Security Appliance Deployment and Administration

Which feature would an administrator use to automatically add a scanned-by header to every message processed by the appliance?

  1. A content filter with an add-header action Correct answer.
  2. A virtual gateway
  3. A destination control
  4. A HAT blocklist entry

Explanation

Content filters support an add-header action that inserts a custom header into processed messages. This is commonly used to indicate that a message was scanned.

Question 26Email Security Appliance Deployment and Administration

An administrator wants the Cisco Email Security Appliance to deliver messages to a different destination host depending on the recipient's domain. Which configuration object is used to define those destination mappings?

  1. A destination control table entry on the public listener Correct answer.
  2. A global SMTP route applied to all listeners
  3. An SMTP authentication profile bound to the outbound listener
  4. A message filter that rewrites the envelope recipient

Explanation

Destination control tables on the appliance map recipient domains to specific destination hosts, so mail for a given domain can be routed to a particular mail exchanger. They are configured per listener, which lets inbound and outbound traffic use different routing decisions.

Question 27Email Security Appliance Deployment and Administration

Which command-line interface command is used on the Cisco Email Security Appliance to review the contents of a quarantine and release messages from it?

  1. destconfig
  2. smtencoding
  3. listenerconfig
  4. quarantineconfig Correct answer.

Explanation

The quarantineconfig command opens the quarantine management area in the CLI, where an administrator can list messages held in each quarantine and release, delete, or forward them. Other configuration commands address unrelated subsystems such as routing and listeners.

Question 28Email Security Appliance Deployment and Administration

An administrator must confirm that the appliance successfully resolved the hostname of a remote mail server before accepting a message. Which appliance feature records this DNS-related session detail?

  1. The reporting engine showing sender reputation scores
  2. The mail_logs log showing the DNS lookup result for the connection Correct answer.
  3. The system log showing configuration commits
  4. The authentication log showing LDAP bind results

Explanation

The mail_logs log records SMTP session events, including the results of DNS lookups performed for the connecting or destination host. Administrators use it to confirm whether name resolution succeeded during a session.

Question 29Email Security Appliance Deployment and Administration

An administrator wants to apply a specific anti-spam policy to messages arriving for one domain while leaving other domains on the default policy. Which configuration approach accomplishes this?

  1. Create a sender group for the domain and set the reputation score threshold
  2. Enable SMTP authentication on the public listener for that domain
  3. Create a mail policy for that domain and attach the desired anti-spam settings to it Correct answer.
  4. Add the domain to the destination control table with a dedicated host

Explanation

Mail policies let the appliance apply different content and anti-spam settings to users or domains. A mail policy matching the domain carries its own anti-spam configuration, so other domains continue to use the default policy.

Question 30Email Security Appliance Deployment and Administration

An administrator needs to configure the appliance so that messages matching a content filter are copied to an additional mailbox while still being delivered to the original recipient. Which content filter action provides this behavior?

  1. Quarantine the message to a policy quarantine
  2. Drop the message silently
  3. Add a blind copy (Bcc) recipient to the message Correct answer.
  4. Redirect the message to an alternate recipient

Explanation

The Bcc action adds an additional envelope recipient while leaving the original recipient intact, so the message is delivered normally and a copy goes to the specified address. This is the standard way to archive or monitor matching traffic without disrupting delivery.

Question 31Email Security Appliance Deployment and Administration

An administrator wants the appliance to reject messages during the SMTP conversation when the sender's domain fails an SPF check, without generating a bounce message later. Which configuration achieves this?

  1. Enable SPF verification and set the action to quarantine
  2. Enable DKIM verification and set the action to drop
  3. Enable DMARC verification and set the action to quarantine
  4. Enable SPF verification on the listener and set the action to reject Correct answer.

Explanation

SPF verification performed on the listener can be set to reject, which returns an SMTP error during the session so the sending MTA receives immediate feedback. Quarantining or dropping delays or suppresses feedback and does not produce a session-level rejection.

Question 32Email Security Appliance Deployment and Administration

An administrator configures a listener to require TLS for inbound sessions from a partner domain. Which setting enforces this requirement?

  1. Set the TLS requirement on the listener to required for that sender group Correct answer.
  2. Enable DKIM signing on the outbound listener
  3. Enable the appliance certificate for the listener and leave TLS optional
  4. Configure a content filter that adds a TLS header

Explanation

TLS enforcement is configured per sender group on a listener, where the administrator can require TLS so that sessions from matching senders must negotiate encryption. If the partner cannot establish TLS, the session is rejected according to the configured setting.

Question 33Email Security Appliance Deployment and Administration

An administrator wants to limit how many concurrent connections a specific external host can open to the appliance. Which feature should be configured?

  1. A mail flow policy with connection limits applied to a matching sender group Correct answer.
  2. A destination control table entry for the host
  3. An SMTP authentication profile for the host
  4. A content filter with a rate-limiting action

Explanation

Mail flow policies define connection behavior such as maximum concurrent connections and recipients per message, and they are bound to sender groups on a listener. Applying a policy to a sender group limits the connections from hosts that match that group.

Question 34Email Security Appliance Deployment and Administration

An administrator needs to add a custom header to messages that were flagged by anti-virus scanning so downstream systems can act on the result. Which mechanism is appropriate?

  1. A listener setting that rewrites the HELO name
  2. A message filter that modifies the SMTP banner
  3. A content filter conditioned on the anti-virus verdict with an add-header action Correct answer.
  4. A quarantine that releases messages automatically

Explanation

Content filters can match on anti-virus verdicts and apply an add-header action, inserting a custom header that downstream systems can inspect. This preserves delivery while exposing the scan result.

Question 35Email Security Appliance Deployment and Administration

An administrator wants the appliance to accept mail for a domain only if the recipient address exists in an external directory, and to reject unknown recipients during the SMTP conversation. Which configuration supports this?

  1. LDAP recipient acceptance with the rejection action set to reject Correct answer.
  2. A destination control table entry for the domain
  3. LDAP recipient acceptance with the rejection action set to drop
  4. A content filter that quarantines messages with unknown recipients

Explanation

LDAP recipient acceptance queries the directory during the SMTP conversation and can be configured to reject unknown recipients immediately. Rejecting returns an SMTP error, giving the sending MTA clear feedback.

Question 36Email Security Appliance Deployment and Administration

An administrator needs to ensure that messages from a specific internal application are accepted for relay even though the host is not listed in the default sender group. Which configuration should be used?

  1. Create a content filter that matches the host's IP address
  2. Add the host to the destination control table
  3. Add the host to a sender group with a mail flow policy that permits relay Correct answer.
  4. Enable SMTP authentication on the public listener

Explanation

Relay permission is governed by the mail flow policy attached to the sender group that matches the connecting host. Placing the host in a sender group whose policy allows relay permits it to send mail through the appliance.

Question 37Email Security Appliance Deployment and Administration

An administrator wants outbound messages to be signed with DKIM using a key published in DNS. Which two elements must be in place for recipients to validate the signature?

  1. An SMTP authentication profile and a PTR record for the appliance
  2. A TLS certificate on the outbound listener and a DMARC record
  3. A DKIM verification profile on the appliance and an SPF record for the domain
  4. A DKIM signing profile on the appliance and a matching public key published in DNS Correct answer.

Explanation

Successful DKIM validation requires the appliance to sign with a private key and the corresponding public key to be published in DNS for the signing domain and selector. Recipients retrieve the public key to verify the signature.

Question 38Email Security Appliance Deployment and Administration

An administrator observes that messages matching a content filter with a quarantine action are not appearing in the expected quarantine. Which configuration issue is the most likely cause?

  1. The destination control table points to an incorrect host
  2. The quarantine was not assigned to the mail policy that processes the matching messages Correct answer.
  3. The appliance certificate has expired
  4. The listener was configured with the wrong TLS setting

Explanation

Quarantines are associated with mail policies, and a content filter's quarantine action applies the quarantine configured for the policy handling the message. If the intended quarantine is not attached to that policy, messages are held elsewhere or follow a different action.

Question 39Email Security Appliance Deployment and Administration

An administrator must ensure that the appliance strips executable attachments from inbound mail while still delivering the remainder of the message. Which configuration achieves this outcome?

  1. A content filter conditioned on attachment type with a strip-attachment action Correct answer.
  2. A mail flow policy that rejects all messages containing attachments
  3. An anti-spam policy that quarantines messages with attachments
  4. A content filter conditioned on attachment type with a drop action

Explanation

The strip-attachment action removes the matching attachment and delivers the rest of the message, which is the desired behavior when only the payload should be blocked. Dropping or rejecting would prevent delivery of the entire message.

Question 40Email Security Appliance Deployment and Administration

An administrator is troubleshooting why messages from a partner are being rejected with a TLS-related error even though the partner supports TLS. Which factor is the most likely cause?

  1. The listener requires TLS but the partner's certificate fails verification against the configured settings Correct answer.
  2. The partner's SPF record does not include the sending IP
  3. The appliance's DKIM key selector is misconfigured
  4. The destination control table lacks an entry for the partner domain

Explanation

When a listener requires TLS, the appliance verifies the partner's certificate according to the configured certificate verification settings. A certificate that fails verification causes the session to be rejected with a TLS error despite the partner supporting encryption.

Question 41Email Authentication and Encryption

Which Cisco Secure Email component is responsible for performing SMTP authentication checks such as SPF, DKIM, and DMARC verification on inbound messages?

  1. The Cisco Secure Email Encryption Service portal
  2. The Email Security Appliance listener with the HAT configured Correct answer.
  3. The Content Security Management appliance quarantine
  4. The on-box message tracking database

Explanation

Inbound authentication checks run on the Email Security Appliance when a message enters through a listener that has the Host Access Table and mail flow policies configured. The listener applies the policy that determines whether SPF, DKIM, and DMARC verification results are used to accept, tag, or reject the message.

Question 42Email Authentication and Encryption

What is the primary function of SPF in email authentication?

  1. It encrypts the message body between servers
  2. It authorizes which IP addresses may send mail for a domain Correct answer.
  3. It signs the message header fields with a private key
  4. It validates the recipient mailbox exists

Explanation

SPF publishes a DNS TXT record listing the hosts authorized to send mail for a domain, and the receiving server checks the connecting IP against that list. It authenticates the envelope sender and the sending IP, not the message contents.

Question 43Email Authentication and Encryption

A DKIM signature in an inbound message fails to verify because the body hash does not match. What does this most directly indicate?

  1. The sending domain published no DKIM key
  2. The SPF record for the domain is malformed
  3. The message arrived over an unencrypted SMTP session
  4. The message body was altered after the signature was applied Correct answer.

Explanation

The body hash in the DKIM-Signature header is a digest of the canonicalized body, so a mismatch means the body changed in transit or after signing. A missing key produces a permerror or temperror result, not a body hash failure.

Question 44Email Authentication and Encryption

Which DMARC policy value instructs a receiving system to take no action on messages that fail alignment but still report on them?

  1. p=quarantine
  2. p=reject
  3. p=none Correct answer.
  4. p=strict

Explanation

With p=none the domain owner is monitoring only, and receivers should deliver failing mail normally while sending aggregate reports. Quarantine and reject request progressively stronger handling of failing messages.

Question 45Email Authentication and Encryption

Which pair of identifiers must align for a message to pass DMARC?

  1. The HELO name and the reverse DNS name
  2. The RFC5322.From domain and a passing SPF or DKIM identifier Correct answer.
  3. The envelope recipient and the Message-ID domain
  4. The TLS certificate subject and the MX record

Explanation

DMARC requires that the domain in the visible From header align with either the SPF-authenticated domain or the DKIM d= domain. Alignment can be strict or relaxed depending on the adkim and aspf tags.

Question 46Email Authentication and Encryption

An administrator wants inbound mail from a partner domain to bypass SPF verification because the partner forwards mail through a relay. Which Host Access Table sender group setting is most appropriate?

  1. A sender group with a policy that enables DKIM verification only
  2. A sender group with a mail flow policy that has SPF verification disabled Correct answer.
  3. A default policy with DMARC quarantine enforced
  4. A blocklist entry for the partner relay IPs

Explanation

The HAT sender group selects the mail flow policy applied to a connecting sender, and that policy controls whether SPF is verified. Disabling SPF for the trusted relay group avoids failing forwarded mail while leaving verification active for everyone else.

Question 47Email Authentication and Encryption

Which DNS record type is used to publish a DMARC policy for a domain?

  1. A TXT record at _dmarc.example.com Correct answer.
  2. A TXT record at the domain apex only
  3. An MX record at _dmarc.example.com
  4. A CNAME record at dmarc.example.com

Explanation

DMARC policy is published as a TXT record at the _dmarc subdomain of the organizational domain, for example _dmarc.example.com. Receivers query that exact name to retrieve the policy tags.

Question 48Email Authentication and Encryption

What does a DKIM selector allow a domain to do?

  1. Choose which DMARC policy applies to a message
  2. Specify the SPF-authorized IP ranges
  3. Encrypt the message body for the recipient
  4. Publish multiple public keys under different names for rotation Correct answer.

Explanation

The selector is the left-hand label of the DKIM DNS name, letting a domain publish several keys at once so keys can be rotated or split by service. Receivers use the s= tag to know which selector to query.

Question 49Email Authentication and Encryption

Which Cisco Secure Email feature lets an administrator enforce TLS for outbound mail to specific domains and fall back to a policy-defined action when TLS is unavailable?

  1. The DKIM signing profile
  2. The SPF verification settings on the listener
  3. Domain-based TLS policies in the Email Security Appliance Correct answer.
  4. The DMARC aggregate report schedule

Explanation

Domain-based TLS policies define required, preferred, or opportunistic TLS per destination domain and specify what happens when the TLS handshake cannot be completed. This gives administrators control over encrypted delivery to specific partners.

Question 50Email Authentication and Encryption

Which statement describes the relationship between MTA-STS and SMTP TLS reporting?

  1. MTA-STS publishes a policy requiring TLS, while TLS reporting sends aggregate reports about TLS negotiation outcomes Correct answer.
  2. MTA-STS is used only for inbound mail, while TLS reporting is used only for outbound mail
  3. MTA-STS replaces SPF, while TLS reporting replaces DKIM
  4. MTA-STS encrypts message bodies, while TLS reporting signs them

Explanation

MTA-STS uses a published policy and a certificate-validated HTTPS fetch to tell senders that TLS is required for the domain. SMTP TLS reporting (RFC 8460) is a separate mechanism that delivers aggregate summaries of successful and failed TLS connections.