View Full Cisco CCNP Security 300-720 Exam Dumps and Practice Test Dumps

 

Question 241. A Cisco Secure Email Gateway administrator wants to allow a trusted partner to send email without being subjected to the same connection restrictions applied to unknown Internet hosts. Which configuration should be used?

1. Configure the partner in an appropriate HAT sender group
2. Add the partner domain to a DLP dictionary
3. Create an AMP exception for all attachments
4. Disable RAT processing on the inbound listener

Correct Answer: 1. Configure the partner in an appropriate HAT sender group

Explanation :-

The Host Access Table classifies SMTP connecting hosts into sender groups and associates those groups with specific mail flow policies. A trusted partner can therefore be placed in a dedicated sender group with appropriate connection limits, TLS requirements, or access permissions. This allows the appliance to distinguish the partner from unknown Internet senders at the SMTP connection stage. DLP dictionaries inspect message content, AMP exceptions affect file analysis, and disabling RAT processing does not provide the required connection-level classification. Using a dedicated HAT sender group provides granular control without changing the policies applied to unrelated Internet hosts.

Question 242. An administrator wants to ensure that the Secure Email Gateway accepts mail only for domains that it is responsible for receiving. Which feature should be configured?

1. SenderBase reputation
2. Recipient Access Table
3. Outbreak Filters
4. AMP for Email

Correct Answer: 2. Recipient Access Table

Explanation :-

The Recipient Access Table (RAT) defines how the Secure Email Gateway handles messages addressed to particular recipient domains. Domains that the appliance is responsible for can be configured as valid recipient domains, while unauthorized destination domains can be rejected. This prevents the gateway from becoming an open relay for arbitrary domains. SenderBase reputation evaluates the reputation of connecting hosts, while Outbreak Filters and AMP address message and file threats. The RAT therefore provides the appropriate control when the administrator needs to restrict inbound SMTP processing to domains hosted or served by the organization.

Question 243. A company wants to require encrypted SMTP communication with a specific partner but does not want to require TLS for every Internet sender. Which configuration provides this behavior?

1. Configure the partner’s domain in a DLP policy
2. Enable DKIM verification globally
3. Configure TLS as required in the applicable mail flow policy
4. Add the partner to an LDAP group

Correct Answer: 3. Configure TLS as required in the applicable mail flow policy

Explanation :-

Mail flow policies allow administrators to define different SMTP security requirements for different categories of traffic. By assigning the partner to an appropriate sender group or destination policy and requiring TLS in the associated mail flow policy, the organization can enforce encrypted SMTP communication specifically for that partner. This avoids applying the same requirement indiscriminately to all Internet connections. DKIM provides message authentication rather than transport encryption, DLP evaluates sensitive information, and LDAP groups are used for directory-related functions. Therefore, configuring required TLS in the applicable mail flow policy provides the desired selective enforcement.

Question 244. An administrator notices that messages addressed to nonexistent users are being accepted and later generating delivery failures. Which configuration can help prevent this behavior at the recipient stage?

1. Enable AMP retrospective scanning
2. Configure URL Filtering
3. Increase the SenderBase threshold
4. Enable LDAP-based recipient validation

Correct Answer: 4. Enable LDAP-based recipient validation

Explanation :-

LDAP-based recipient validation allows the Secure Email Gateway to query an organization’s directory service to determine whether a recipient address exists. When configured appropriately, the gateway can reject messages for invalid recipients before accepting and processing the entire message. This reduces unnecessary mail processing and can help prevent backscatter caused by accepting messages for nonexistent users. AMP retrospective scanning addresses later malware verdict changes, URL Filtering evaluates URLs, and SenderBase reputation evaluates sending-host reputation. Therefore, LDAP recipient validation is the appropriate solution when the objective is to prevent acceptance of messages addressed to nonexistent users.

Question 245. A security administrator needs to identify messages containing sensitive financial information and quarantine them for review. Which feature is designed specifically for this requirement?

1. Data Loss Prevention
2. Host Access Table
3. SMTP routing
4. Recipient Access Table

Correct Answer: 1. Data Loss Prevention

Explanation :-

Data Loss Prevention (DLP) is designed to identify sensitive information in email messages and attachments based on configured policies and data identifiers. An organization can use DLP to detect information such as financial data, regulated information, or other sensitive content and then apply an action such as quarantine. HAT controls SMTP connection access, SMTP routing determines how mail is forwarded, and RAT controls recipient acceptance. DLP therefore provides the appropriate inspection capability for identifying sensitive financial information. The resulting action can be configured according to the organization’s security and compliance requirements.

Question 246. An administrator wants to investigate whether a particular email was delivered, quarantined, or rejected. Which Secure Email Gateway feature should be used first?

1. DKIM configuration
2. Message Tracking
3. DNS MX configuration
4. DLP dictionaries

Correct Answer: 2. Message Tracking

Explanation :-

Message Tracking provides message-specific information about how an email was processed by the Secure Email Gateway. Administrators can search for a message and examine events associated with acceptance, filtering, quarantine, delivery, or rejection. This makes Message Tracking particularly useful when troubleshooting an individual message rather than evaluating general appliance statistics. DKIM configuration relates to email authentication, DNS MX records influence mail routing, and DLP dictionaries define sensitive-data detection criteria. Therefore, Message Tracking should be used first when the administrator needs to determine what happened to a particular email during its processing lifecycle.

Question 247. A company wants to protect users from malicious links contained in incoming messages by applying URL reputation and category-based controls. Which feature should be configured?

1. Recipient Access Table
2. SNMP
3. URL Filtering
4. SMTP AUTH

Correct Answer: 3. URL Filtering

Explanation :-

URL Filtering provides controls for evaluating URLs contained in email messages and applying policies based on URL reputation or categorization. It can help organizations identify potentially malicious or inappropriate destinations and take configured actions when messages contain URLs that match selected conditions. RAT controls recipient domains, SNMP provides monitoring capabilities, and SMTP AUTH provides authentication for supported SMTP submission scenarios. URL Filtering is therefore the appropriate feature when the objective is to apply security controls to links contained within email messages. Administrators should configure categories and actions according to the organization’s security policy.

Question 248. An administrator needs to classify connecting SMTP clients before applying connection limits and access rules. Which component performs this classification?

1. HAT sender groups
2. DLP policies
3. Quarantine policies
4. DKIM selectors

Correct Answer: 1. HAT sender groups

Explanation :-

Host Access Table (HAT) sender groups classify SMTP connections based on the connecting host. Administrators can place trusted, internal, partner, or untrusted hosts into different sender groups and then associate those groups with appropriate mail flow policies. This classification occurs during SMTP connection processing, allowing connection limits and access decisions to be applied before normal message processing occurs. DLP evaluates message content, quarantine holds messages after applicable processing, and DKIM selectors are associated with cryptographic signing and verification. Therefore, HAT sender groups are responsible for classifying SMTP clients so that appropriate connection policies can be applied.

Question 249. A receiving organization wants to verify that an email’s sending IP address is authorized by the domain owner. Which email authentication mechanism provides this check?

1. DKIM
2. DLP
3. SPF
4. RAT

Correct Answer: 3. SPF

Explanation :-

Sender Policy Framework (SPF) allows a domain owner to publish DNS information identifying the hosts or IP addresses authorized to send email for that domain. A receiving system can compare the connecting or sending IP address against the published SPF policy and generate an SPF result such as pass, fail, or softfail. DKIM instead uses a cryptographic signature to authenticate message content and a signing domain. DLP evaluates sensitive information, while RAT controls recipient acceptance. Therefore, SPF is the mechanism used when the receiving organization needs to determine whether the sending IP is authorized by the domain’s published policy.

Question 250. An administrator wants to use DMARC to determine whether authentication results align with the domain shown in the visible From address. Which two authentication mechanisms does DMARC evaluate?

1. SMTP and LDAP
2. SPF and DKIM
3. SNMP and SMTP AUTH
4. DLP and AMP

Correct Answer: 2. SPF and DKIM

Explanation :-

DMARC builds on SPF and DKIM and evaluates their authentication results together with domain alignment. Alignment helps determine whether the authenticated domain information corresponds appropriately to the domain presented in the visible From address. A DMARC policy is published through DNS and can specify how receiving systems should handle messages that fail the required authentication and alignment conditions. SMTP and LDAP are not the two authentication mechanisms underlying DMARC, and DLP and AMP address content and malware security. Therefore, SPF and DKIM are the authentication mechanisms evaluated by DMARC.

Question 251. A company wants to sign outbound messages so that receiving organizations can verify that the message was associated with the company’s domain and that signed content was not altered. Which configuration should be implemented?

1. SPF record only
2. RAT recipient entry
3. HAT sender group
4. DKIM signing

Correct Answer: 4. DKIM signing

Explanation :-

DKIM signing allows an outbound mail system to attach a cryptographic signature to designated portions of an email. The receiving system can retrieve the public key published in DNS and use it to validate the signature. This provides a mechanism for verifying that the message was signed by a domain-controlled key and that the signed content has not been altered after signing. SPF alone does not sign messages; it evaluates authorization of sending IP addresses. HAT and RAT control SMTP access and recipient handling. Therefore, DKIM signing is the appropriate configuration for outbound cryptographic message authentication.

Question 252. A security administrator wants to hold messages that trigger a specific content condition instead of immediately rejecting them during the SMTP connection. Which feature is most appropriate?

1. Message Filters
2. SenderBase reputation
3. Recipient Access Table
4. SMTP routing

Correct Answer: 1. Message Filters

Explanation :-

Message Filters allow administrators to create conditions based on message characteristics and then apply configured actions when those conditions are met. Conditions can evaluate information such as message headers, subject content, body content, sender information, or other supported message attributes. An action can be configured to quarantine matching messages rather than immediately reject the SMTP connection. SenderBase evaluates sending-host reputation, RAT controls recipient acceptance, and SMTP routing determines delivery paths. Therefore, Message Filters are appropriate when a message must be inspected for a specific condition and then held for administrative review.

Question 253. An administrator receives an SMTP response indicating that the remote server is temporarily unavailable and the message should be retried later. Which response code represents this type of condition?

1. 250
2. 550
3. 451
4. 220

Correct Answer: 3. 451

Explanation :-

SMTP response code 451 generally indicates a temporary failure. A sending system can normally retry delivery when the receiving server returns a temporary response. Temporary failures can result from service availability problems, resource constraints, or temporary policy conditions. Code 250 indicates successful completion, 550 commonly represents a permanent failure, and 220 is generally associated with an SMTP service-ready greeting. When troubleshooting repeated delivery delays, administrators should review Message Tracking and the remote server’s complete SMTP response to determine why the temporary failure occurred and whether subsequent retries were successful.

Question 254. An administrator needs to restrict SMTP connections from a sender that has exceeded the allowed connection rate. Where should this type of connection-level control generally be configured?

1. DKIM verification
2. Mail Flow Policy
3. DLP dictionary
4. URL Filtering

Correct Answer: 2. Mail Flow Policy

Explanation :-

Mail Flow Policies provide controls that determine how SMTP traffic is handled for traffic associated with an applicable sender group. Connection-related limits and other SMTP behavior can be configured through the policy assigned to that traffic. This allows an administrator to apply stricter controls to a sender that generates excessive connections without necessarily imposing the same limits on every sender. DKIM verifies message signatures, DLP identifies sensitive information, and URL Filtering evaluates URLs in messages. Therefore, a Mail Flow Policy is the appropriate configuration area for connection-level restrictions such as connection-rate or concurrency controls.

Question 255. A company wants the Secure Email Gateway to reject a message when the intended recipient does not exist in the corporate directory. Which two components work together to provide this functionality?

1. LDAP recipient validation and the recipient access configuration
2. AMP and URL Filtering
3. DKIM and SenderBase
4. SNMP and SMTP routing

Correct Answer: 1. LDAP recipient validation and the recipient access configuration

Explanation :-

LDAP recipient validation allows the Secure Email Gateway to query the organization’s directory to determine whether a recipient address is valid. The recipient access configuration establishes how recipient domains and addresses are handled by the appliance. Together, these mechanisms can prevent the gateway from accepting mail addressed to nonexistent users. AMP and URL Filtering address threats within message content, while DKIM and SenderBase provide authentication and reputation-related functions. SNMP is used for monitoring, and SMTP routing determines delivery paths. Therefore, LDAP recipient validation combined with the appropriate recipient access configuration provides the required recipient verification capability.

Question 256. A security team wants protection against newly emerging email attacks that may involve a sudden campaign or rapidly changing threat characteristics. Which Secure Email Gateway capability is specifically designed to provide protection against emerging outbreaks?

1. Recipient Access Table
2. Outbreak Filters
3. LDAP authentication
4. SMTP routing

Correct Answer: 2. Outbreak Filters

Explanation :-

Outbreak Filters are designed to help protect email systems against emerging or rapidly developing threats. They can apply additional controls when security intelligence identifies characteristics associated with an email outbreak or widespread campaign. This provides a layer of protection that can respond to emerging threats before traditional static filtering alone may be sufficient. RAT controls recipient acceptance, LDAP supports directory-based lookups, and SMTP routing determines how messages are delivered. Therefore, Outbreak Filters are the feature most directly associated with providing protection against emerging email outbreaks and rapidly developing campaigns.

Question 257. An administrator needs to monitor operational information from multiple Secure Email Gateway appliances using an existing network-management platform. Which capability should be enabled?

1. DLP
2. SMTP routing
3. SNMP
4. DKIM signing

Correct Answer: 3. SNMP

Explanation :-

Simple Network Management Protocol (SNMP) provides a standard method for integrating network and security appliances with centralized monitoring systems. A network-management platform can use supported SNMP information to monitor appliance conditions and, depending on the configuration, receive notifications about relevant events. DLP focuses on sensitive information detection, SMTP routing controls mail delivery paths, and DKIM signing provides cryptographic email authentication. None of those features is designed to provide centralized appliance monitoring. Therefore, SNMP is the appropriate capability for integrating multiple Secure Email Gateway appliances with an existing network-management platform.

Question 258. An administrator notices that an outbound message is repeatedly being deferred because the destination server is temporarily refusing connections. Which tool provides the most useful message-specific information for troubleshooting this condition?

1. Message Tracking
2. DLP dictionaries
3. RAT configuration
4. DKIM selector

Correct Answer: 1. Message Tracking

Explanation :-

Message Tracking provides detailed information about the processing and delivery attempts associated with individual messages. When an outbound message is repeatedly deferred, Message Tracking can help identify the destination server, delivery attempts, SMTP responses, and current processing state. This information can help determine whether the problem is a temporary remote-server condition, a routing issue, or another delivery-related problem. DLP dictionaries identify sensitive information, RAT controls recipient domains, and DKIM selectors are used for cryptographic signing or verification. Therefore, Message Tracking is the most useful starting point when investigating repeated delivery deferrals for a specific outbound message.

Question 259. A company wants to prevent unauthorized users from sending messages through an SMTP listener intended for authenticated mail submission. Which capability can provide user authentication for SMTP submission?

1. SenderBase reputation
2. SMTP AUTH
3. Outbreak Filters
4. DLP

Correct Answer: 2. SMTP AUTH

Explanation :-

SMTP AUTH provides a mechanism for authenticating users or clients before allowing them to submit email through an SMTP service configured to support authentication. It is useful when an organization wants to restrict mail submission to authenticated users rather than allowing unrestricted submission through a listener. SenderBase reputation evaluates sending-host reputation, Outbreak Filters address emerging email threats, and DLP detects sensitive information. SMTP AUTH should be configured together with appropriate listener and access-control settings so that only intended users or systems can submit mail through the authenticated service.

Question 260. An administrator wants to determine why a message that passed the initial SMTP connection stage was later placed into quarantine. Which approach provides the most useful investigation?

1. Review only the DNS MX record
2. Disable the HAT sender group
3. Review Message Tracking together with the applicable filtering and quarantine policies
4. Replace the listener IP address

Correct Answer: 3. Review Message Tracking together with the applicable filtering and quarantine policies

Explanation :-

A message can pass the initial SMTP connection controls and still be quarantined later because of anti-spam, content filtering, DLP, malware scanning, URL controls, or another message-processing policy. Message Tracking provides the message-specific processing history needed to identify what occurred, while reviewing the applicable filtering and quarantine policies helps explain why the final action was taken. DNS MX records primarily affect mail routing, HAT controls the SMTP connection stage, and changing a listener IP does not explain an existing message disposition. Therefore, combining Message Tracking with the relevant filtering and quarantine policy information provides the most useful troubleshooting approach.