[UPDATED 2026] Free Cisco 300-720 Exam Questions Self-Assess Preparation
300-720 Free Sample Questions to Practice One Year Update
Cisco 300-720 exam, also known as Securing Email with Cisco Email Security Appliance, is designed for professionals who specialize in network security and email security. Securing Email with Cisco Email Security Appliance certification exam focuses on the knowledge and skills required to secure email messages and protect organizations against advanced email threats. It is ideal for security professionals who want to enhance their expertise in email security and gain recognition for their skills in the field.
NEW QUESTION # 146
What are two phases of the Cisco ESA email pipeline? (Choose two.)
- A. action
- B. quarantine
- C. delivery
- D. workqueue
- E. reject
Answer: C,D
Explanation:
With DomainKeys or DKIM email authentication, the sender signs the email using public key cryptography. Configuring DomainKeys and DKIM Signing A signing key is the private key stored on the appliance. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_010101.html?bookSearch=true
NEW QUESTION # 147
Users have been complaining of a higher volume of emails containing profanity. The network administrator will need to leverage dictionaries and create specific conditions to reduce the number of inappropriate emails.
Which two filters should be configured to address this? (Choose two.)
- A. spam
- B. content
- C. VOF
- D. sender group
- E. message
Answer: B,E
Explanation:
Message filter and content filter are two filters that should be configured to address this issue. Message filter and content filter are rules that allow Cisco ESA to perform actions on messages based on predefined or custom conditions, such as headers, envelope, body, attachments, etc.
To reduce the number of inappropriate emails containing profanity, the network administrator can create a dictionary that contains a list of profane words or phrases and use it as a condition in a message filter or content filter that applies an action of "drop", "quarantine", or "modify subject" on the matching messages.
The other options are not valid filters to address this issue, because they do not use dictionaries or conditions based on message content.
NEW QUESTION # 148
Which SMTP extension does Cisco ESA support for email security?
- A. STARTTLS
- B. ETRN
- C. UTF8SMTP
- D. PIPELINING
Answer: A
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/ b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011000.html
NEW QUESTION # 149
A company has recently updated their security policy and now wants to drop all email messages larger than
100 MB coming from external sources. The Cisco Secure Email Gateway is LDAP integrated and all employee accounts are in the group " Employees " . Which filter rule configuration provides the desired outcome?
- A. if (mail-from-group != ' Employees ' ) and (body-size > 100M) {drop();}
- B. if (mail-from-group == ' Employees ' ) and (body-size > 100M) {bounce();}
- C. if ( ' mail-from-group != Employees ' ) and (body-size > 100M) {drop();}
- D. if (mail-from-group == ' Employees ' ) and (body-size > " 100M " ) {drop()}
Answer: D
NEW QUESTION # 150
Which two options describe the expected results when centralized policy, virus, and outbreak quarantines are disabled on the Cisco Email Security Appliance? (Choose two.)
- A. The Cisco ESA stops accepting new messages.
- B. The Cisco ESA must be rebooted.
- C. New messages sent to the quarantine are immediately sent to local quarantines
- D. Local quarantines are enabled automatically.
- E. The quarantine process must be restarted.
Answer: C,D
NEW QUESTION # 151
An engineer is testing mail flow on a new Cisco ESA and notices that messages for domain abc.com are stuck in the delivery queue. Upon further investigation, the engineer notices that the messages pending delivery are destined for 192.168.1.11, when they should instead be routed to 192.168.1.10.
What configuration change needed to address this issue?
- A. Modify the SMTP route for the domain and change the IP address to 192.168.1.10.
- B. Add an address list for domain abc.com.
- C. Modify Destination Controls entry for the domain abc.com.
- D. Modify the Routing Tables and add a route for IP address to 192.168.1.10.
Answer: A
Explanation:
Reference:
You can use the SMTP route feature on Cisco ESA to specify how messages for a specific domain are routed to their destination. You can modify the SMTP route for the domain abc.com and change the IP address to 192.168.1.10 to ensure that messages are delivered correctly3. Reference = Securing Email with Cisco Email Security Appliance (SESA) v3.1
NEW QUESTION # 152
Which Cisco ESA security service is configured only through an outgoing mail policy?
- A. DLP
- B. antivirus
- C. Outbreak Filters
- D. AMP
Reference https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/ b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_01001.html
Answer: A
NEW QUESTION # 153
Which global setting is configured under Cisco ESA Scan Behavior?
- A. actions for unscannable messages due to attachment type
- B. minimum depth of attachment recursion to scan
- C. minimum attachment size to scan
- D. attachment scanning timeout
Answer: A
Explanation:
The global setting that is configured under Cisco ESA Scan Behavior is the actions for unscannable messages due to attachment type. This setting allows the administrator to specify what action to take when a message contains an attachment that cannot be scanned by the appliance, such as encrypted or password-protected files. The possible actions are:
Deliver - Deliver the message normally.
Drop - Drop the message silently without notifying the sender or recipient.
Quarantine - Quarantine the message in a specified policy quarantine.
Bounce - Bounce the message back to the sender with a specified reason.
Reference:
Scan Behavior
NEW QUESTION # 154
A network engineer is reviewing the record presented.
Name: big-email._domainkey.mywebsite.com
Data: v=DKIM1; k=rsa; p= REPLACE_WITH_YOUR_PUBLIC_KEY
Which type of DNS record would contain the record as per the DKIM public key RFC 6376?
- A. SRV
- B. MX
- C. TXT
- D. PTR
Answer: C
Explanation:
DKIM public keys are published in the DNS using TXT records as specified by RFC 6376. The recipient's mail server uses the selector and domain to look up this TXT record and retrieve the public key for signature verification.
NEW QUESTION # 155
When a network engineer is troubleshooting a mail flow issue, they discover that some emails are rejected with an SMTP code of 451 and the error message " #4.7.1 Unable to perform DMARC verification " . In the DMARC verification profile on the Cisco Secure Email Gateway appliance, which action must be set for messages that result in temporary failure to prevent these emails from being rejected?
- A. Accept
- B. No Action
- C. Quarantine
- D. Ignore
Answer: A
Explanation:
Accept is the action that must be set for messages that result in temporary failure to prevent these emails from being rejected. Accept allows Cisco ESA to deliver the messages without applying any DMARC actions or modifications.
To configure the accept action for messages that result in temporary failure on Cisco ESA, the administrator can follow these steps:
* Select Mail Policies > DMARC Verification Profile and click Edit Settings for the DMARC verification profile that applies to the messages.
* Under DMARC Actions, select Accept from the drop-down menu for Messages That Result in Temporary Failure.
* Click Submit.
The other options are not valid actions for messages that result in temporary failure to prevent these emails from being rejected, because they either apply DMARC actions or modifications or do nothing.
References: [User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway], page 11-4 and page 11-5.
NEW QUESTION # 156
Which Cisco ESA security service is configured only through an outgoing mail policy?
- A. DLP
- B. AMP
- C. antivirus
- D. Outbreak Filters
Answer: A
NEW QUESTION # 157
A Cisco ESA administrator must provide outbound email authenticity and configures a DKIM signing profile to handle this task. What is the next step to allow this organization to use DKIM for their outbound email?
- A. Configure the Trusted Sender Group message authenticity policy.
- B. Enable the DKIM service checker.
- C. Import the DNS record of the service provider into the Cisco ESA.
- D. Export the DNS TXT record to provide to the DNS registrar.
Answer: D
Explanation:
ESA - Configure DKIM Signing
- Create a DKIM signing key
- Generate a new DKIM signing profile and publish the DNS record to DNS.
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/213939-esa-configure-dkim-signing.pdf
NEW QUESTION # 158
Which two components must be configured to perform DLP scanning? (Choose two.)
- A. Enable a DLP policy on the DLP Policy Customizations.
- B. Add a DLP policy to the Outgoing Content Filter.
- C. Add a DLP policy on the Incoming Mail Policy.
- D. Enable a DLP policy on the Outgoing Mail Policy.
- E. Add a DLP policy to the DLP Policy Manager.
Answer: D,E
Explanation:
To perform DLP scanning on Cisco ESA, two components must be configured:
* Add a DLP policy to the DLP Policy Manager, which is a repository of predefined or custom DLP policies that specify what types of data to scan for and what actions to take if a match is found.
* Enable a DLP policy on the Outgoing Mail Policy, which is a set of rules that determine how outgoing messages are processed by Cisco ESA, including whether to apply DLP scanning or not.
References: User Guide f or AsyncOS 15.0 for Cisco Secure Email Gateway , page 9-2 and page 9-4.
Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/ b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_010001.html
NEW QUESTION # 159
What is the maximum message size that can be configured for encryption on the Cisco ESA?
- A. 25 MB
- B. 30 MB
- C. 20 MB
- D. 15 MB
Answer: A
Explanation:
The maximum message size that can be configured for encryption on the Cisco ESA is 25 MB. This is the default value for the Maximum Message Size for Encryption setting in the Encryption Profile. Messages that exceed this size will not be encrypted and will be delivered as normal.
NEW QUESTION # 160
Which content filter condition checks to see if the " From: header " in the message is similar to any of the users in the content dictionary?
- A. SPF Verification
- B. Subject Header
- C. Duplicate Boundaries Verification
- D. Forged Email Detection
Answer: D
Explanation:
The content filter condition that checks to see if the "From: header" in the message is similar to any of the users in the content dictionary is Forged Email Detection. This condition compares the sender's name or email address with a list of names or email addresses in a content dictionary and triggers an action if they match or are similar. References : [Cisco Secure Email Gateway Administrator Guide - Forged Email Detection]
NEW QUESTION # 161
What is the purpose of checking the CRL during SMTP authentication on a Cisco Secure Email Gateway?
- A. Verify the common name matches user ID
- B. Validate the date to check if the certificate is still valid
- C. Check if the certificate is not revoked.
- D. Confirm that corresponding CA is present
Answer: C
Explanation:
The purpose of checking the Certificate Revocation List (CRL) during SMTP authentication on a Cisco Secure Email Gateway is to check if the certificate is not revoked by the issuing Certificate Authority (CA). A revoked certificate means that it is no longer valid and should not be trusted. Reference = [User Guide for AsyncOS 12.0 for Cisco Email Security Appliances - GD (General Deployment) - Configuring SMTP Authentication [Cisco Secure Email Gateway] - Cisco]
NEW QUESTION # 162
What is a valid content filter action?
- A. archive
- B. quarantine
- C. decrypt on delivery
- D. skip antispam
Answer: B
Explanation:
A content filter action is an operation that Cisco ESA performs on a message if it matches the conditions of a content filter rule, such as headers, envelope, body, attachments, etc. Quarantine is a valid content filter action that allows Cisco ESA to store the message in a quarantine area for further review or release by an administrator or an end user. The other options are not valid content filter actions on Cisco ESA.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/ b_ESA_Admin_Guide_chapter_01010.html#con_1158022
NEW QUESTION # 163
Which two steps are needed to disable local spam quarantine before external quarantine is enabled? (Choose two.)
- A. Uncheck the Enable Spam Quarantine check box.
- B. Check the External Safelist/Blocklist check box.
- C. Select Security Services and click Spam Quarantine.
- D. Select Monitor and click Spam Quarantine.
- E. Select External Spam Quarantine and click on Configure.
Answer: A,D
Explanation:
Reference:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118555-qa-esa- 00.html (configuration summary)
NEW QUESTION # 164
A Cisco ESA administrator has noticed that new messages being sent to the Centralized Policy Quarantine are being released after one hour. Previously, they were being held for a day before being released.
What was configured that caused this to occur?
- A. The threshold settings were set to default.
- B. The retention period was set to default.
- C. The threshold settings were set to override the clock settings.
- D. The retention period was changed to one hour.
Answer: B
Explanation:
You can configure Policy, Virus, and Outbreak Quarantines in any one of the following ways:
Choose Quarantine > Other Quarantine > View > +.
Choose Monitor > Policy, Virus, and Outbreak Quarantines and do one of the following.
Click Add Policy Quarantine.
Keep the following in mind, changing the retention time of the File Analysis quarantine from the default of one hour is not recommended.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_011111.html?bookSearch=true
NEW QUESTION # 165
Which setting affects the aggressiveness of spam detection?
- A. maximum depth of recursion scan
- B. spam threshold
- C. spam timeout
- D. protection level
Answer: B
Explanation:
Apply more aggressive spam thresholds if false-positives are less of a concern than missed spam:
- Reduce the Positive Spam Threshold to 80 (default is 90) if false-positives are not a concern at the 'certain' threshold.
- Reduce Suspected Spam Threshold to 40 (default is 50) if false-positives are not a concern at the 'suspect' threshold.
NEW QUESTION # 166
Which two components must be configured to perform DLP scanning? (Choose two.)
- A. Enable a DLP policy on the DLP Policy Customizations.
- B. Add a DLP policy to the Outgoing Content Filter.
- C. Add a DLP policy on the Incoming Mail Policy.
- D. Enable a DLP policy on the Outgoing Mail Policy.
- E. Add a DLP policy to the DLP Policy Manager.
Answer: D,E
Explanation:
To perform DLP scanning on Cisco ESA, two components must be configured:
Add a DLP policy to the DLP Policy Manager, which is a repository of predefined or custom DLP policies that specify what types of data to scan for and what actions to take if a match is found.
Enable a DLP policy on the Outgoing Mail Policy, which is a set of rules that determine how outgoing messages are processed by Cisco ESA, including whether to apply DLP scanning or not.
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_010001.html
NEW QUESTION # 167
Which two components form the graymail management solution in Cisco ESA? (Choose two.)
- A. improved mail efficacy
- B. cloud-based unsubscribe service
- C. integrated graymail scanning engine
- D. uniform unsubscription management interface for end users
- E. secure subscribe option for end users
Answer: B,C
Explanation:
The graymail management solution in the appliance comprises of two components: an integrated graymail scanning engine and a cloud-based Unsubscribe Service. The integrated graymail scanning engine identifies graymail messages using various criteria and assigns them to different categories. The cloud-based Unsubscribe Service provides an easy mechanism for end users to unsubscribe from unwanted messages by checking the reputation of the unsubscribe links and performing the unsubscribe process on behalf of the end user.
References: User Guide for AsyncOS 12.0 for Cisco Email Security Appliances - GD (General Deployment)
, Chapter: Managing Graymail, Section: Graymail Management Solution in Email Security Appliance Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/ b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01101.pdf (p.2)
NEW QUESTION # 168
An organization has a strict policy on URLs embedded in emails. The policy allows visibility into what the URL is but does not allow the user to click it. Which action must be taken to meet the requirements of the security policy?
- A. Redirect the URL to the Cisco security proxy.
- B. Defang the URL.
- C. Replace the URL with text.
- D. Enable the URL quarantine policy.
Answer: B
Explanation:
Defanging a URL means modifying it so that it is not clickable and cannot be directly accessed by a user, but still retains the visible structure of the original URL. This allows users to see the URL for informational purposes without being able to click on it and potentially open a malicious site.
Common defanging methods include replacing certain characters (like "." with "[dot]" or "http" with
"hxxp") to render the URL non-functional while keeping it recognizable.
NEW QUESTION # 169
What are organizations trying to address when implementing a SPAM quarantine?
- A. false negatives
- B. true negatives
- C. false positives
- D. true positives
Answer: C
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100000.html#con_1482874 False positives are legitimate messages that are incorrectly identified as spam by the Cisco ESA. Organizations may want to implement a spam quarantine to reduce the risk of losing false positive messages and allow users or administrators to review and release them2. Reference = User Guide for AsyncOS 12.0 for Cisco Email Security Appliances - GD (General Deployment) - Spam Quarantine [Cisco Secure Email Gateway] - Cisco
NEW QUESTION # 170
A recent engine update was pulled down for graymail and has caused the service to start crashing. It is critical to fix this as quickly as possible.
What must be done to address this issue?
- A. Roll back to a previous version of the engine from the Services Overview page.
- B. Roll back to a previous version of the engine from the System Health page.
- C. Download another update from the Service Updates page.
- D. Download another update from the IMS and Graymail page.
Answer: A
Explanation:
The Services Overview page lists the current service and rule versions of the following engines:
Graymail
McAfee
Sophos
You can perform the following tasks in the Services Overview page:
Manually update the engines. For more information, see Manually Updating the Engines Rollback to previous version of the engine. For more information, see Rollback to Previous Version of Engine
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100010.html
NEW QUESTION # 171
......
Real exam questions are provided for CCNP Security tests, which can make sure you 100% pass: https://torrentpdf.exam4tests.com/300-720-pdf-braindumps.html