Test-king q

Transcription

1 Test-king q Number: Passing Score: 800 Time Limit: 120 min File Version: Security for Field Engineers Passed on with an 890. Dump still valid in US. 1 or 2 new questions. You must know the material as answers are worded differently at times.

2 Exam A QUESTION 1 By default, how do Outbreak filters avoid quarantining false positives? A. False positives do not occur as the Anti-Virus engine will check the signature against the incoming mail. Only positive matches against the signature are quarantined for checking later on. B. False positives are released as updates provide a better description of suspected attachment. C. Positive matches are not quarantined. They are dropped. D. All false positives must be quarantined until a Virus signature is received so that they can be checked. Correct Answer: B /Reference: : QUESTION 2 Which of the following two RAT entries will accept mail for example.com and all of its sub- domains? (Choose two.) A. *@example.com B..example.com C. example.com D. *@*.example.com Correct Answer: BC /Reference: : QUESTION 3 A new C-160 has been delivered and needs to be configured. What subnet and C-Series interface does your laptop need to be configured on? A. Data /24 B. Data /24 C. Data /24 D. Data /24 Correct Answer: D /Reference: : QUESTION 4 Which command is used to enable weighted filtering in an Security Appliance? A. policyconfig B. dictionaryconfig C. filters D. weightedconfig Correct Answer: B

3 /Reference: : QUESTION 5 Which option describes when a DLP incident occurs? A. when potentially sensitive content appears in a message B. when one or more users receive classified information via C. when a system administrator fails to enable the DLP feature key D. if a message contains a number that looks like a credit card number Correct Answer: A /Reference: : QUESTION 6 Which option correctly describes the encryption technologies that should be used with "TLS Preferred" Guaranteed Secure Delivery? A. Try to use TLS. If it fails, use envelope encryption. B. Try envelope encryption first. If it fails, use TLS. C. Always use envelope encryption. D. Always use TLS. If TLS fails, bounce the message. Correct Answer: A /Reference: : QUESTION 7

4 Refer to the exhibit. Based on the Add Condition menu which of listed file attachments will be matched? (Choose two.) A. A.msi attachment that has had its file extension changed to.pdf B. A.pdf attachment that has had its file extension changed to.exe. C. A.pdf attachment D. A.exe attachment. Correct Answer: BD /Reference: : QUESTION 8 While running the system setup wizard, what are the default settings for Senderbase Network Participation and Auto Support? A. SBNP: onauto Support: on B. SBNP: onauto Support: off C. SBNP: offauto Support: off D. SBNP: offauto Support: on Correct Answer: A /Reference: : QUESTION 9 At what point in the SMTP conversation can the SMTP client send message headers? A. Between RCPTTO and DATA B. Between HELO and MAIL FROM C. Between DATA and a period"." on a single line

5 D. Between MAIL FROM and RCPTTO /Reference: : QUESTION 10 What is the best solution to prevent directory harvest attacks? A. Create an access list as a content dictionary and match this resource, with a content filter, against incoming s. B. Specify all of the legitimate mailbox addresses in the RAT. C. Enable LDAP Accept. D. Create an access list as a content dictionary and match this resource, with a message filter, against incoming s /Reference: : QUESTION 11 Which of the following security features are enabled for outgoing mail by default? (Choose three) A. MCAfee Anti-Virus B. bounce verification C. IronPort Anti-Spam D. Sophos Anti-Virus E. Outbreak filters DE /Reference: : QUESTION 12 Your customer is using the encryption plug-in for Microsoft Outlook. Which content filter condition is used to match on the tag that is set by the plug-in? A. Envelope sender B. Other header C. Attachment content D. Message body E. Subject header Correct Answer: B /Reference: :

6 QUESTION 13 Which option describes the difference between public and private listeners? A. Only the public listener can be configured to process incoming mail. B. Both can be used for inbound and outbound traffic. C. Public listeners can be configured to use port 80. D. Private listeners do not have a host access table. Correct Answer: A /Reference: : QUESTION 14 Which two options are default characteristics of the RSA DLP feature? (Choose two.) A. It is not enabled on the Cisco ESA. B. It requires an SSL certificate to be enabled. C. It cannot be disabled without the admin password. D. It requires a feature key. E. It is a built-in feature, and it is enabled by default. Correct Answer: AD /Reference: : QUESTION 15 Membership in which sender group will cause the C-Series-to skip checking the SMTP envelope's "rcpt to" field against the RAT? A. SUSPECTLIST B. WHITELIST C. RELAYLIST D. BLACKLIST E. UNKNOWNLIST /Reference: : QUESTION 16 Which option is the proper syntax of the nslookup command in the Cisco ESA CLIto list mail exchangers for domain "cisco.com"? A. nslookup -d cisco.com -t mx B. nslookup mx cisco.com C. nslookup -type=mx cisco.com D. nslookup cisco.com mx Correct Answer: B

7 /Reference: : QUESTION 17 Which content cannot be blocked by content filters? A. RSADLP failure B. DKIM failure C. SPF failure D. credit card numbers Correct Answer: AB /Reference: : QUESTION 18 When you accept the default settings for the system setup wizard, which two outgoing policies are disabled? (Choose two.) A. Recipient access table B. Message filters C. Antispam D. Content filters D /Reference: : QUESTION 19 Under which menu tab is Cisco Registered Envelope Service accessed for provisioning? A. System Administration B. Security Services C. Network D. Mail Policies E. Monitor Correct Answer: B /Reference: :

8 QUESTION 20 Refer to the exhibit. You have finished installing a C-160 that is designed to filter incoming and relay outgoing mail for the mail server exchange.bravo.com. This is a one armed installation. The incoming mail cannot be received from any source on the internet. According to the mail log, what is the most likely problem? A. The mail server needs to point to a private listener instead of a public listener. B. Exchange.bravo.com needs to be configured on the RELAYLIST C. An SMTP route needs to be configured for exchange.bravo.com D. Exchange.bravo.com needs to be configured in the RAT E. Exchange.bravo.com needs to be removed from the SUSPECTLIST /Reference: : QUESTION 21 Refer to the exhibit. Based on the LDAP directory, what attribute names contain the value brian@exchange.bravo.com? (Choose two.)

9 A. maillocaladdress B. mailroutingaddress C. mail D. userprincipalname E. samacccountname Correct Answer: BC /Reference: : QUESTION 22 Your customer has the default spam settings on their appliance. They need an immediate reduction in missed spam, but without increasing their false positive rate. How should you advise them? A. Enable Intelligent Multi-Scan B. Enable Marketing Mail Detection. C. In the HAT settings, increase the SBRS threshold for the BLACKLIST sender group. D. Advise their end users to use the spam plugin or send false negatives samples to ham@access.ironport.com Correct Answer: A /Reference: : IronPort Intelligent Multi-Scan incorporates multiple anti-spam scanning engines, including IronPort Anti- Spam, to provide an intelligent, multi-layer anti-spam solution. This method provides more accurate verdicts that increase the amount of spam that is caught but without increasing the false positives rate. References: QUESTION 23 In the DLP Policy Manager, you have changed the "Action Applied to Messages:" from the default setting to "drop" for those messages with critical severity. All other severity settings are left at default. What action will be applied to messages classified at medium severity? A. Deliver B. Drop C. Quarantine D. Encrypt Correct Answer: A /Reference: : QUESTION 24 Which of the following steps must be performed when configuring the C-Seriesto handle incoming mail for a new mail domain? The installation involves a one armed configuration with a single listener. A separate mail server is configured in the new domain. (Choose two.) A. Add the new mail server to the RELAYLIST of the OutgoingMail Listener B. Configure an SMTP route to the new mail server. C. Add the new mail server to the RELAYLIST of the IncomingMail Listener

10 D. Add the new mail domain to the HAT E. Add the new mail domain to the RAT Correct Answer: BE /Reference: : QUESTION 25 Refer to the exhibit. Can the next step be to configure the encrypt action in a content filter? A. Yes. CRES has been added. The next step is to configure the outgoing mail policy. B. Yes. CRES has been added. The next step is to create the content filter. C. No. First you need to commit your changes, and click Provision. D. No. First you need to click the provision button. /Reference: : QUESTION 26 When accepting the default settings for the system setup wizard, which of the following are not applied to incoming mail? (Choose two.) A. Outbreak Filters B. Content Filters C. IronPort Anti-Spam D. Message Filters E. Host Access Table

11 F. Recipient Access Table G. Anti-Virus Correct Answer: DG /Reference: : QUESTION 27 Which two options describe the expected results when centralized policy, virus, and outbreak quarantines are disabled on the Cisco Security Appliance? (Choose two.) A. The Cisco ESA must be rebooted. B. New messages sent to the quarantine are immediately sent to local quarantines C. The Cisco ESA stops accepting new messages. D. Local quarantines are enabled automatically. E. The quarantine process must be restarted. Correct Answer: BD /Reference: : QUESTION 28 When a Bypass Receiving Control is enabled for a RAT entry, which function is bypassed? A. Reverse DNS Lookup B. Mail Flow Policies: Max. Recipients Per Hour Code C. LDAP Accept Query D. Reputation Filtering Correct Answer: B /Reference: : QUESTION 29 Which packet capture option filters out only SMTP traffic to and from IP address ? A. src= proto=smtp B. dst= and port=25 C. host and port 25 D. src or dst and proto smtp /Reference: : QUESTION 30 Which statement about the grep command is true?

12 A. The grep command is not available in the CLI. B. Its behavior is configurable with the scanconfig CLI command C. It performs a case-insensitive search. D. It performs a case-sensitive search. Correct Answer: D /Reference: : QUESTION 31 Which option describes when DLP scanning occurs in the pipeline? A. Between anti-virus and anti-spam check B. Immediately after outbreak filters C. Before anti-spam check D. After message filters and before content filters Correct Answer: B /Reference: : QUESTION 32 In the IronPott C-Series, which of the following control the SMTP conversation? (Choose two.) A. Outbreak Filters B. Content Filters C. IronPort Anti-Spam D. Message Filters E. Recipient Access Table F. Host Access Table G. Anti-Virus Correct Answer: EF /Reference: : QUESTION 33 Using the customer requirements suggest the appropriate licenses for a single appliance. The C- Series will handle both incoming and outgoing . The customer is very concerned about tracking and preventing phishing and virus attacks. What are three choices for licenses? (Choose three.) A. Sophos Anti-Virus

13 B. IronPort Encryption C. Bounce Verification D. IronPort Anti-Spam E. Outbreak Filters F. Centralized Management Correct Answer: ADE /Reference: : QUESTION 34 Refer to the exhibit. Based on the content filter which attachments will be quarantined? (Choose two.) A. pdf attachment. B. A.exe attachment. C. A.pdf attachment that has had its file extension changed to.exe D. A.msi attachment that has had its file extension changed to.pdf Correct Answer: AD /Reference: : QUESTION 35 If the marketing message detection feature mislabels legitimate mail as marketing, which action corrects this error? A. Turn off Marketing Message Detection. B. Whitelistthe domains that send the mislabeled messages. C. Send samples of mislabeled legitimate mail to ham@access.ironport.com. D. Send samples of mislabeled legitimate mail to adds@access.ironport.com.

14 /Reference: : QUESTION 36 Using the customer requirements select the appropriate licenses keys that are needed. Customer wants to implement CRES on their outgoing mail. Incoming mail is handled by a hosted service. (Choose two.) A. IronPort Encryption B. Bounce Verification C. IronPort Anti-Spam D. Incoming Mail Handling / Receiving E. Outbreak Filters F. Sophos Anti-Virus Correct Answer: AD /Reference: : QUESTION 37 In a "one armed installation" using a single listener, how would the system differentiate between incoming and outgoing ? A. Mail flow direction is determined by the "Recipient to" field in the SMTP envelope. B. Mail flow direction is determined by the type of listener, public verses private. C. Mail flow direction is determined by using the source IP address. D. Mail flow direction is determined by the "Mail From" field in the SMTP envelope. /Reference: : QUESTION 38 Refer to the exhibit. You have finished an installation, but the customer cannot receive mail from a business partner. Based on the mail log, how should you explain this to the customer? How can you allow this mail to be accepted into the customer's domain? A. Allow mail delivered from this site by changing the RAT settings from moderate to conservative. B. Have their business partner contact IronPort support to adjust their reputation score. C. The business partner's MTA has been blocked based on their reputation. Adjust the settings on the blacklist from -10 to to -10 to-7.7. The suspectlist will scan this domain for spam D. The business partner's MTA has been blocked based on their reputation. Suggest whitelisting their

15 partner's domain, but caution them about anti-spam being disabled. Correct Answer: D /Reference: : QUESTION 39 Refer to the exhibit. Based on the content filter condition menu, which of the following statements is correct? A. If the word "secret" is present in the message an action will take place. B. If the word "secret" is present in either the message body or attachment, an action will take place. C. If the word "secret" occurs a total of three times in either the message body or attachments, an action will take place D. If the ABA routing number is present in either the message body or attachment, an action will take place. /Reference: : QUESTION 40 Which approach for SenderBase Reputation Score filtering would ensure a very small false positive rate and achieve better system performance? A. Generic B. Aggressive C. Moderate D. Basic

16 E. Conservative /Reference: : QUESTION 41 Which option describes the function of the RSA Enterprise Manager? A. Centralized reporting B. Management of the encryption profile C. Management of mail policies D. Management of quarantined messages E. Centralized management of DLP polices, remediation, and reporting Correct Answer: E /Reference: : QUESTION 42 Which option describes when LDAP domain assignments are used? A. When not all users are in the directory B. When just some users are in the directory C. When users are in separate domains, each of which has their own directory D. When users in the same domain are split over different directories /Reference: : QUESTION 43 Which of the following parameters are used by the Anti-Spam engine? (Choose three.) A. The number of recipients in the RCPTTO list. B. The characteristics of the message (random dots, multiple colors) C. The sending mail domains reputation D. The reputation of URLs in the message E. Analysis of image content using optical character recognition Correct Answer: BCD /Reference: : QUESTION 44 Which three options are Cisco ESA facilities that can use LDAP group queries? (Choose three.)

17 A. Anti-spam settings B. Sender groups C. Message filters D. RAT E. Incoming mail policies F. Content filters G. Destination controls H. SenderBase reputation filtering Correct Answer: BDH /Reference: : QUESTION 45 When configuring CRES, where do you enable read receipts? A. In the encryption profile B. In the content filter condition menu C. In the content filter action menu D. In the mail policy Correct Answer: A /Reference: : QUESTION 46 Which option describes how the Cisco ESA fits into a network? A. It process POP3 messages. B. It handles SMTP-related traffic by routing the packets. C. It works as a mail exchange. D. The product should be installed in the DMZ. Correct Answer: B /Reference: : QUESTION 47 Which two service problems can the Cisco Security Appliance solve? (Choose two.) A. DLP B. IPS C. Antispam D. URL filtering Correct Answer: AC

18 /Reference: : QUESTION 48 Which of the following is designed to block message campaigns that the recipient unknowingly subscribed to? A. Anti-Spam B. Anti-Virus C. Marketing Mail Detection D. Reputation Filters /Reference: : QUESTION 49 Which ESA feature is used to apply smart identifiers? A. Content filters B. RSA data loss prevention engine C. Encryption policies D. Text resources Correct Answer: A /Reference: : QUESTION 50 Using default settings, what describes the difference between rating suspect and positive spam? A. Suspect spam is scored between 50 and 74 and positive is 75 or greater. B. Suspect spam is matched into the SUSPECTLIST, where as Positive spam matches on the BLACKLIST. C. Suspect spam is scored between 50 and 89 and positive is 90 or greater. D. Suspect spam has a reputation score between-1 and-3 and positive is between-3 and-10. /Reference: : QUESTION 51 Which of the following features need to be enabled to create reports representing trends across a

19 company with several C-Series appliances? (Choose two.) A. Centralized Reporting on the M-Series B. Localized Reporting on the M-Series C. Centralized Reporting on the C-Series D. Localized Reporting on the C-Series Correct Answer: AC /Reference: : QUESTION 52 Which two CLI commands allow us to retrieve the XML configuration file for backup purposes? (Choose two.) A. saveconfig B. getconfig C. backupconfig D. mailconfig E. loadconfig F. scanconfig Correct Answer: AD /Reference: : QUESTION 53 Which of the following filters can only be applied to outbound messages? A. DLP B. Anti-Virus C. Anti-Spam D. Outbreak Correct Answer: A /Reference: : QUESTION 54 Which of the following types of DNS records deals with mail delivery for a specific domain? A. A B. TXT C. MX D. PTR

20 /Reference: : QUESTION 55 Which ESA function maintains a set of rules that control incoming connections from remote hosts for a listener? A. LDAP B. HAT C. VEST D. Sender group E. RAT Correct Answer: B /Reference: : QUESTION 56 By default, the outgoing mail will be scanned by which one of the following? A. Reputation Filters B. Anti-Virus C. Anti-Spam D. Outbreak Filters Correct Answer: B /Reference: : QUESTION 57 Which of the following vendors produce Anti-Virus engines for the C-Series? (Choose two.) A. Symantec B. TrendMicro C. BrightMail D. Sophos E. MCAfee Correct Answer: DE /Reference: : QUESTION 58 During which stage in a mail flow on a Cisco Security Appliance does content filtering occur? A. Reputation filtering (SBRS) > message filters > antispam > antivirus > content filter > mail policies B. Reputation filtering (SBRS) > message filters > mail policies > antispam > antivirus > content filter C. Reputation filtering (SBRS) > message filters > content filter > mail policies > antispam > antivirus D. Reputation filtering (SBRS) > mail policies > message filters > antispam > antivirus > content filter

21 Correct Answer: D /Reference: : QUESTION 59 When the Cisco ESA is configured to use Centralized Message Tracking, which default port is used between the device and the Cisco Security Management Appliance? A. port 53/UDP B. port 80/UDP C. port 23/TCP D. port 25/UDP E. port 22/TCP Correct Answer: E /Reference: : QUESTION 60 When saving a configuration file that will be reloaded into the appliance, which one of the following must be changed before saving? A. Unmask the password strings B. Shut down the mail listeners C. Clustered systems must be un-clustered D. Feature key strings must be recorded Correct Answer: A /Reference: : QUESTION 61 Which default port is used by the Cisco ESA to quarantine the message on the Cisco Security Management Appliance? A. port 25fTCP B. port110/tcp C. port443/tcp D. port 6025/TCP E. port4766/udp Correct Answer: D /Reference: : QUESTION 62 Which statement describes how the Cisco Security Appliance connects to these hosts if multiple LDAP servers are specified for a single profile?

22 A. Load balancing or failover operation is configurable in the LDAP server profile. B. It load balances or fails over depending on the LDAP server priority value. C. It fails over in the order listed. D. It load balances connections among all hosts listed. Correct Answer: D /Reference: : QUESTION 63 Which of the following security features are enabled for incoming mail by default? (Choose three.) A. McAfee Anti- Virus B. IronPort Anti-Spam C. Bounce verification D. Sophos Anti-Virus E. Outbreak filters Correct Answer: BDE /Reference: : QUESTION 64 Which two network topologies can be configured on the Cisco C170 appliance? (Choose two.) A. The Data 1 interface is configured with one public listener. The Data 2 interface is configured with a private listener.management access is performed through a third Ethernet interface that is dedicated to management. B. The Data 1 and Data 2 interfaces in a NIC pairing configuration support one public listener, management, and a relay list. C. The Data 1 interface is configured with one public listener, management, and a relay list. The Data 2 interface is not used D. The Data 1 interface is configured with one public listener. The Data 2 interface is configured with a private listener.management is on either interface. Correct Answer: A /Reference: