View Full Cisco CCNP Security 300-720 Exam Dumps and Practice Test Dumps

 

Q61. A Cisco Secure Email Gateway administrator needs to prevent unauthorized SMTP clients from relaying messages through the appliance. Which configuration should be used to control which connecting hosts are permitted to relay mail?

1. Recipient Access Table (RAT)
2. Host Access Table (HAT)
3. Outbreak Filters
4. Message Filters

Correct Answer: 2. Host Access Table (HAT)

Explanation :-

The Host Access Table (HAT) controls SMTP access based on the connecting host and determines how the Secure Email Gateway handles SMTP connections from remote systems. HAT entries can classify hosts into sender groups and associate them with mail flow policies. This allows administrators to control whether systems are accepted, rejected, throttled, or permitted to relay. The Recipient Access Table (RAT), in contrast, controls which recipient domains and addresses the appliance accepts. Outbreak Filters and Message Filters operate later in message processing and are not designed to provide the primary SMTP connection-level relay control.

Q62. An administrator wants the Secure Email Gateway to reject messages addressed to recipients that do not exist in the organization’s directory. Which integration is most appropriate for this requirement?

1. LDAP recipient validation
2. DNS TXT lookup
3. Outbreak Filters
4. AMP file reputation

Correct Answer: 1. LDAP recipient validation

Explanation :-

LDAP recipient validation allows the Secure Email Gateway to query an external directory such as Microsoft Active Directory to determine whether an SMTP recipient is valid. When an incoming message is addressed to an unknown recipient, the appliance can reject the message during SMTP processing rather than accepting it and generating a later bounce. This reduces directory harvesting and unnecessary mail processing. DNS TXT records, Outbreak Filters, and AMP file reputation serve different purposes and do not provide authoritative validation of whether an individual recipient exists in the organization’s directory.

Q63. A company wants to authenticate sending systems before allowing them to submit mail through the Secure Email Gateway. Which capability addresses this requirement?

1. URL Filtering
2. SMTP authentication
3. SenderBase Reputation
4. Outbreak Filters

Correct Answer: 2. SMTP authentication

Explanation :-

SMTP authentication allows a client to authenticate before submitting email through an SMTP listener configured to support authenticated submission. This is useful when an organization needs to permit trusted users or applications to send mail while preventing unauthorized systems from using the gateway as an open relay. Sender reputation evaluates the reputation of connecting hosts, while URL Filtering evaluates links in messages. Outbreak Filters identify suspicious message campaigns or emerging threats. Therefore, SMTP authentication directly addresses the requirement to authenticate the submitting client before accepting mail.

Q64. An organization wants to ensure that messages exchanged with a business partner are encrypted while traveling between their mail gateways. Which configuration should be considered?

1. DLP dictionaries
2. SMTP TLS configuration
3. Message tracking
4. Anti-Spam quarantine

Correct Answer: 2. SMTP TLS configuration

Explanation :-

SMTP TLS provides encryption for SMTP communication between mail systems when both parties support the required TLS behavior. Secure Email Gateway administrators can configure TLS policies for inbound and outbound mail and apply specific requirements to partner domains when necessary. This protects SMTP traffic while it is transmitted between systems, although it does not by itself provide end-to-end message encryption after delivery. DLP dictionaries identify sensitive content, Message Tracking provides visibility into message processing, and Anti-Spam quarantine handles suspicious messages rather than encrypting SMTP sessions.

Q65. An administrator needs to create a policy that applies only to messages originating from a particular group of trusted IP addresses. Which Secure Email Gateway mechanism is most appropriate for identifying those connecting hosts?

1. HAT sender groups
2. DLP policies
3. URL reputation
4. Recipient Access Table

Correct Answer: 1. HAT sender groups

Explanation :-

HAT sender groups classify connecting SMTP hosts according to attributes such as IP address and associate those hosts with mail flow policies. This allows administrators to apply different SMTP access and processing behavior to trusted, untrusted, or specially controlled groups of senders. DLP policies focus on sensitive information contained in messages, while URL reputation evaluates links and the Recipient Access Table controls recipient acceptance. Because the requirement is based specifically on the identity of the connecting host, HAT sender groups provide the appropriate mechanism.

Q66. A security administrator wants to require TLS for email received from a specific partner domain. Which configuration is most directly relevant?

1. Outbreak Filter policy
2. Mail Flow Policy associated with the partner
3. AMP retrospective verdict
4. Message Tracking query

Correct Answer: 2. Mail Flow Policy associated with the partner

Explanation :-

Mail Flow Policies define how the Secure Email Gateway handles SMTP connections and messages from particular sender groups or domains. TLS requirements can be applied through appropriate mail flow configuration so that communication with a specific partner follows the organization’s encryption policy. Outbreak Filters address emerging message threats, AMP provides malware analysis and reputation services, and Message Tracking is a monitoring function. The exact TLS behavior depends on the listener and policy configuration, but a partner-specific mail flow policy is the appropriate policy framework for enforcing differentiated SMTP handling.

Q67. A message has already been accepted by the Secure Email Gateway, but the administrator needs to determine which processing steps were applied and whether the message was delivered, quarantined, or rejected later in processing. Which feature should be used?

1. Message Tracking
2. HAT
3. DNS MX records
4. SMTP authentication

Correct Answer: 1. Message Tracking

Explanation :-

Message Tracking provides detailed visibility into how individual messages move through the Secure Email Gateway. Administrators can use it to search for messages and review events such as receipt, filtering, scanning, quarantine actions, delivery attempts, and final processing status. This makes it particularly useful for troubleshooting missing or delayed email. HAT controls connection-level access, DNS MX records determine mail routing information, and SMTP authentication verifies clients. None of those features provides the same level of per-message processing history as Message Tracking.

Q68. An organization wants to prevent employees from sending messages containing confidential customer information. Which Secure Email Gateway capability is designed specifically for identifying sensitive information and applying a policy?

1. DLP
2. SenderBase Reputation
3. HAT
4. DNS

Correct Answer: 1. DLP

Explanation :-

Data Loss Prevention (DLP) policies are designed to detect and control sensitive information leaving the organization. DLP rules can identify patterns or data types associated with confidential information and then trigger actions such as quarantine, rejection, notification, or encryption depending on the configured policy. SenderBase Reputation evaluates sender reputation, HAT controls SMTP connection handling, and DNS provides name-resolution and mail-routing information. DLP is therefore the appropriate capability when the primary requirement is preventing the unauthorized transmission of sensitive organizational or customer data.

Q69. An administrator observes that a message containing a malicious attachment initially receives a favorable malware assessment, but a later analysis changes the verdict. Which capability can support action based on updated malware intelligence?

1. Retrospective malware detection
2. Recipient Access Table
3. SMTP authentication
4. HAT sender group

Correct Answer: 1. Retrospective malware detection

Explanation :-

Retrospective malware detection allows a security system to respond when new intelligence changes the assessment of previously processed content. A file that was not initially identified as malicious can later receive a malicious verdict after additional analysis or threat intelligence becomes available. The Secure Email Gateway can use updated verdict information to support investigation and remediation workflows. RAT and HAT control SMTP access and recipient handling, while SMTP authentication controls client authentication. These mechanisms do not provide retrospective malware analysis or updated threat verdict processing.

Q70. A company wants to verify that its domain has authorized mail servers and reduce the likelihood of forged messages being accepted by recipients. Which DNS-based email authentication mechanism publishes authorized sending hosts?

1. DKIM
2. DMARC
3. SPF
4. MX

Correct Answer: 3. SPF

Explanation :-

Sender Policy Framework (SPF) uses a DNS TXT record to publish the hosts or services authorized to send email for a domain. Receiving systems can compare the connecting SMTP server against the published SPF policy. DKIM instead uses cryptographic signatures associated with the sending domain, while DMARC builds on authentication results and provides domain-level policy and reporting. MX records identify mail exchangers responsible for receiving mail for a domain. Therefore, SPF directly addresses the requirement to publish which systems are authorized to send mail on behalf of a domain.

Q71. A receiving organization wants to use domain-level policy to specify how messages that fail SPF or DKIM alignment should be handled. Which standard provides this policy framework?

1. HAT
2. DMARC
3. RAT
4. LDAP

Correct Answer: 2. DMARC

Explanation :-

Domain-based Message Authentication, Reporting, and Conformance (DMARC) provides a framework for domain owners to publish policies governing messages that fail authentication and alignment requirements. DMARC can use SPF and DKIM results and provides mechanisms for reporting authentication outcomes. HAT and RAT are Secure Email Gateway mechanisms for SMTP access and recipient control, while LDAP provides directory integration. DMARC therefore addresses the domain-level policy requirement for handling messages that fail the organization’s authentication and alignment expectations.

Q72. An administrator needs to determine whether an outbound message was delivered successfully to the destination mail server or encountered an SMTP delivery failure. Which information source is most useful?

1. Message Tracking and delivery events
2. DLP dictionaries
3. URL reputation
4. LDAP schema

Correct Answer: 1. Message Tracking and delivery events

Explanation :-

Message Tracking records message-processing activity and can provide useful information about outbound delivery attempts, SMTP responses, routing decisions, and final message status. This information helps administrators distinguish between successful delivery, temporary delivery failures, permanent rejections, and messages that were held for additional processing. DLP dictionaries define sensitive-data detection patterns, URL reputation evaluates web links, and LDAP schema information describes directory structures. For troubleshooting an outbound delivery problem, message-level tracking and associated delivery events provide the most direct evidence.

Q73. A Secure Email Gateway administrator wants to limit the rate at which a particular sender can submit messages. Which policy capability can be used to control this behavior?

1. Mail Flow Policy rate controls
2. DKIM signing
3. DLP dictionaries
4. Message Tracking

Correct Answer: 1. Mail Flow Policy rate controls

Explanation :-

Mail Flow Policies can be used to apply connection and message handling controls to defined sender groups. Rate controls can help limit the volume or frequency of messages accepted from a particular source and are useful for controlling abusive, compromised, or high-volume senders. DKIM provides message authentication through cryptographic signatures, DLP detects sensitive content, and Message Tracking provides visibility rather than enforcing traffic limits. Rate controls should therefore be implemented through the applicable mail flow policy for the sender group that requires throttling.

Q74. An administrator needs to determine why a remote mail server is being rejected before the message body is accepted. Which configuration should be reviewed first?

1. HAT and the associated sender group
2. DLP dictionaries
3. AMP file analysis
4. URL Filtering

Correct Answer: 1. HAT and the associated sender group

Explanation :-

If a remote SMTP server is rejected before the message is fully accepted, the administrator should first investigate connection-level controls. The Host Access Table determines how connecting hosts are classified and which SMTP access policy is applied to them. Sender group membership, host reputation, access rules, and associated mail flow behavior can therefore explain an early rejection. DLP, AMP, and URL Filtering generally operate on message content or URLs after the connection and message have progressed further. Reviewing HAT and the applicable sender group is consequently the appropriate first troubleshooting step.

Q75. An organization wants to automatically inspect URLs in email messages and apply security policy based on the reputation or categorization of those URLs. Which feature provides this capability?

1. LDAP recipient validation
2. URL Filtering
3. SMTP authentication
4. NTP

Correct Answer: 2. URL Filtering

Explanation :-

URL Filtering allows the Secure Email Gateway to inspect URLs contained in messages and apply security controls based on available reputation or categorization information. This can help identify links associated with malicious, suspicious, or otherwise restricted destinations. LDAP recipient validation determines whether recipients exist, SMTP authentication verifies clients, and NTP provides time synchronization. URL inspection is particularly useful against phishing and malicious-link campaigns because a message can appear legitimate while directing the recipient to a harmful destination.

Q76. A company wants the Secure Email Gateway to synchronize its system clock with a reliable external time source so that logs and security events have consistent timestamps. Which protocol should be configured?

1. SMTP
2. LDAP
3. NTP
4. SNMP

Correct Answer: 3. NTP

Explanation :-

Network Time Protocol (NTP) synchronizes system clocks with configured time sources. Accurate time is important for Secure Email Gateway operations because message tracking, logs, alerts, certificates, and security investigations depend on reliable timestamps. SMTP transports email, LDAP provides directory services, and SNMP is primarily used for monitoring and management information. Configuring NTP ensures that the appliance maintains an accurate system clock and that events recorded across multiple security and mail systems can be correlated more reliably.

Q77. An administrator wants monitoring software to receive notifications when important appliance events occur without continuously polling every status value. Which SNMP capability is relevant?

1. SNMP traps
2. SMTP relay
3. LDAP bind
4. DNS MX lookup

Correct Answer: 1. SNMP traps

Explanation :-

SNMP traps allow a monitored device to send asynchronous notifications to an SNMP management system when configured events occur. This can reduce the need for the monitoring platform to repeatedly poll the appliance for every event. SMTP relay concerns email transport, LDAP bind establishes communication with a directory service, and DNS MX lookups identify mail exchangers. When an administrator needs event-driven monitoring notifications from the Secure Email Gateway, SNMP traps are the relevant mechanism.

Q78. A message is being rejected because the recipient domain is not configured as an accepted destination on the Secure Email Gateway. Which configuration should the administrator inspect?

1. Recipient Access Table
2. Host Access Table
3. AMP policy
4. URL Filtering

Correct Answer: 1. Recipient Access Table

Explanation :-

The Recipient Access Table (RAT) controls which recipient domains and addresses the Secure Email Gateway accepts for inbound delivery. If a recipient domain is not recognized as an accepted destination, the RAT configuration should be reviewed to verify that the domain is correctly defined and associated with the appropriate listener behavior. The HAT controls connecting hosts rather than recipient destinations. AMP focuses on malware detection, while URL Filtering evaluates links. Therefore, the RAT is the primary configuration to inspect when recipient-domain acceptance is the issue.

Q79. An organization wants to sign outbound email so receiving systems can verify that the message was authorized by the sending domain and was not modified after signing. Which technology should be configured?

1. SPF
2. DKIM
3. RAT
4. NTP

Correct Answer: 2. DKIM

Explanation :-

DomainKeys Identified Mail (DKIM) uses a cryptographic signature associated with the sending domain. The receiving system can retrieve the corresponding public key through DNS and use it to validate the signature. Successful validation provides evidence that the message was signed by an authorized domain-controlled key and that signed content was not altered in transit. SPF validates the sending host against a domain’s published policy but does not sign the message. RAT controls recipients, while NTP synchronizes system time. DKIM is therefore the appropriate technology for message signing and integrity verification.

Q80. During troubleshooting, an administrator discovers that a message is repeatedly held in a quarantine instead of being delivered. Which action should be taken first to determine the cause?

1. Review the message’s tracking and quarantine events
2. Change the appliance hostname
3. Disable DNS resolution
4. Remove all LDAP mappings

Correct Answer: 1. Review the message’s tracking and quarantine events

Explanation :-

Message Tracking and quarantine event information provide the most direct evidence for determining why a specific message was held. The administrator can identify which policy or security engine caused the quarantine and then review the associated rule, verdict, or action. Changing the hostname, disabling DNS, or removing LDAP mappings would not directly explain why an individual message was quarantined and could introduce unrelated operational problems. Troubleshooting should begin with the message’s recorded processing history before making configuration changes.