Content Security
Content Security (15%) covers email and web traffic control: Cisco Secure Email (gateway and cloud), Cisco Secure Web Appliance, Umbrella, AMP/file reputation, DLP, and mail authentication. Questions usually ask you to pick the right control for a specific threat.
Email path and controls
Inbound mail hits a listener, then the Host Access Table, which uses sender reputation (SenderBase) to accept, throttle, or reject. Then come message filters and content filters, outbreak filters (virus, virus outbreak, spam, phishing), AMP file reputation and detonation, DLP, and optional encryption. Outbreak filters are rule-based and target a campaign; content filters match conditions you define - do not swap them.
SPF, DKIM, DMARC
SPF authorizes sending IPs via a DNS TXT record and checks the envelope sender. DKIM signs the message with a domain key so the header and body hash can be verified. DMARC requires alignment: the From-header domain must match an SPF-passing envelope domain or a DKIM d= domain, then applies p=none, quarantine, or reject and sends aggregate reports. None of the three encrypts mail, and SPF alone does not protect the visible From header, which is why business email compromise still lands.
Web controls
Cisco Secure Web Appliance proxies explicit (client configured/PAC) or transparent (WCCP, PBR) traffic. It enforces URL category and reputation-based policies, application visibility and control, anti-malware via reputation plus engines, DLP, and HTTPS decryption, which requires a trusted certificate on the endpoint. Umbrella enforces at DNS, catching malicious domains earlier without decryption. AMP file reputation returns clean, malicious, or unknown; unknown files go to Secure Malware Analytics for sandbox detonation, and verdicts can change later (retrospective).
Worked example
A vendor's legitimate message is quarantined by DMARC. The SPF check passes, but the message was forwarded through a mailing list that rewrote the envelope sender, so the SPF domain is no longer aligned with the From domain, and the list also broke the DKIM body hash. Because neither SPF nor DKIM aligns, DMARC fails and the p=quarantine policy is applied. The fix is to make the vendor's DKIM survive forwarding, not to relax SPF.
Traps that cost marks
Believing SPF protects the From header; confusing outbreak filters with content filters; assuming DMARC provides encryption; forgetting that HTTPS decryption breaks certificate-pinned applications; and mixing up file reputation (instant verdict) with sandbox analysis (behavioral, slower).