Cisco 300-720 SESA study plan

Map every deployment mode (physical, virtual, cloud/SMA-adjacent) to its licensing, interface, and listener implications, and write a one-page comparison from memory

Configure a working appliance end to end: initial CLI setup wizard, network interfaces, default gateway, DNS, and NTP, then verify with CLI show commands

Differentiate the listener types (public, private, inbound vs outbound relay) and predict which listener an inbound SMTP session will hit based on IP and port

Describe how the GUI, CLI, and API overlap for administration and identify which tasks are CLI-only

Configure and test SMTP routes, including a default route and a host-specific route, and verify routing decisions with the message tracking tool

Set up LDAP/AD acceptance queries and external authentication, then prove acceptance and authentication work with a test user

Explain how the appliance handles TLS on inbound and outbound listeners and configure certificate-based listener security

Troubleshoot a simulated delivery failure using mail logs, message tracking, and queue management commands

Configure SPF, DKIM, and DMARC verification on an inbound mail flow policy and interpret the authentication-results headers each adds

Generate and publish a DKIM signing key for an outbound domain and verify signing behavior on a test message

Configure domain-based encryption policies and TLS-required delivery, then test opportunistic versus required TLS

Explain how message encryption, TLS, and certificate management differ and when each is applied

Tune anti-spam settings: HAT sender groups, mail flow policies, and per-policy spam thresholds, and justify each threshold choice

Configure content-based and reputation-based filtering and describe how outbreak filters differ from traditional antivirus signatures

Set up quarantine categories and release/delete workflows, including end-user quarantine notification and access

Explain graymail, marketing mail, and false-positive handling strategies and where each is configured

Build content filters with message-body, attachment, and header conditions, and order them so the intended filter fires first

Configure message filters and compare them with content filters on trigger, scope, and action capabilities

Design a DLP policy with a classifier, a custom identifier, and a remediation action (quarantine, encrypt, notify)

Trace which policy wins when content filters, message filters, and DLP overlap on the same message

Configure outbound mail policies including TLS requirements, encryption, and rate limiting to prevent accidental data exposure

Set up and use the SMA for centralized quarantine, policy, and reporting, and describe what changes when an SMA is added

Integrate the appliance with directory services and external threat intelligence sources, and verify the data flows

Diagnose policy conflicts and misrouted messages using message tracking filters and log subscriptions

Configure centralized management and clustering concepts, and explain how configuration is replicated across appliances

Set up log subscriptions, alerting, and reporting to catch delivery failures and policy hits

Practice backup and restore, configuration export, and upgrade planning steps

Work through five troubleshooting scenarios covering queue backup, DNS failure, TLS negotiation failure, license issues, and listener misconfiguration

Re-derive the key configuration decisions from memory for each domain without notes, then check against your lab

Complete timed practice across all five domains and review every missed item to its underlying concept

Re-run your weakest two labs from earlier weeks without the runbook

Summarize the top ten exam traps (for example, filter ordering, listener matching, TLS modes) in your own words