Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118692configure-esa-00.html#anc7

Changing the end user quarantine access setting from None authentication to Mailbox is the correct

way to enforce end user authentication before accessing quarantine. This setting requires the end

users to enter their email address and password in order to access their personal quarantine on the

Cisco ESA.

The other options are not valid ways to enforce end user authentication before accessing quarantine,

because they do not affect the end user quarantine access setting.

Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-2 and page 10-3.

one of the methods to enable Cisco SecureX integration on a Cisco Secure Email Gateway appliance

is to use the Threat Response service1. This service allows the appliance to send telemetry data to

the SecureX cloud and provide visibility and response capabilities across multiple security

products1. To use this service, the administrator needs to perform the following steps1:

Enable the Threat Response service: The administrator needs to go to Network > Cloud Service

Settings and enable the Threat Response service. This will generate a registration token that can be

used to register the appliance with SecureX1.

Select the correct Threat Response Server: The administrator needs to select the appropriate Threat

Response server based on the region where the appliance is located. The available regions are North

America, Europe, and Asia Pacific1.

Outgoing Mail Policy is a mail policy that should be created to accomplish this task. Outgoing Mail

Policy is a set of rules that determine how outgoing messages are processed by Cisco ESA, including

whether to apply DLP scanning or not.

To create an Outgoing Mail Policy named ‘Sales’ and assign a DLP policy to it, the administrator can

follow these steps:

Select Mail Policies > Outgoing Mail Policies and click Add Policy.

Enter ‘Sales’ as the policy name and click Submit.

Select ‘Sales’ from the list of policies and click Edit Settings.

Under Data Loss Prevention, select Enable Data Loss Prevention Scanning and choose the DLP policy

from the drop-down menu.

Click Submit.

The other options are not valid mail policies to accomplish this task, because they do not apply to

outgoing messages or DLP scanning.

Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 9-2 and page 9-4.

Custom policy is a type of DLP policy template that must be used to create a policy that meets this

requirement. Custom policy allows the administrator to define their own criteria for detecting

sensitive or confidential data in messages, such as keywords, regular expressions, file types, etc.

To create a custom DLP policy on Cisco ESA, the administrator can follow these steps:

Select Mail Policies > DLP Policy Manager and click Add Policy.

Enter a name and description for the DLP policy, such as Patent Protection.

Under Policy Template, select Custom Policy.

Click Submit.

Under Content Matching Criteria, click Add Criteria.

Choose a matching type, such as Keyword or Regular Expression, and enter a value that matches the

proprietary patent documents, such as “patent number” or “\d{4}/\d{6}”.

Click Submit.

The other options are not valid types of DLP policy templates to create a policy that meets this

requirement, because they are predefined templates that do not match the proprietary patent

documents.

Reference: [User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway], page 9-3 and page 9-5.

The purpose of checking the Certificate Revocation List (CRL) during SMTP authentication on a Cisco

Secure Email Gateway is to check if the certificate is not revoked by the issuing Certificate Authority

(CA). A revoked certificate means that it is no longer valid and should not be trusted. Reference =

[User Guide for AsyncOS 12.0 for Cisco Email Security Appliances - GD (General Deployment) -

Configuring SMTP Authentication [Cisco Secure Email Gateway] - Cisco]

The default method of remotely accessing a newly deployed Cisco Secure Email Virtual Gateway

when a DHCP server is not available is to use the IP address of 192.168.42.42 via the Management

port. This IP address is assigned by default to the Management port of the virtual gateway and can

be used to access the web user interface or the command-line interface of the appliance. Reference:

[Cisco Secure Email Gateway Installation and Upgrade Guide - Configuring Network Settings]

A TXT record is a type of DNS record that contains arbitrary text data that can be used for various

purposes such as verification, configuration, or authentication. A TXT record can contain the DKIM

public key per RFC 6376, which is used to verify the digital signature of an email message generated

by the DKIM private key of the sender domain.

The other options are not valid because:

A. A CNAME record is a type of DNS record that maps an alias name to a canonical name or another

alias name. It does not contain any DKIM public key information.

B. An AAAA record is a type of DNS record that maps a hostname to an IPv6 address. It does not

contain any DKIM public key information.

D. A PTR record is a type of DNS record that maps an IP address to a hostname, which is the reverse

of an A or AAAA record. It does not contain any DKIM public key information.

Relay is the connection behavior that must be selected to properly process the messages. Relay

allows Cisco ESA to accept messages from the specified source and deliver them to the intended

destination, without applying any content or reputation filters.

To configure a mail flow policy with relay connection behavior on Cisco ESA, the administrator can

follow these steps:

Select Mail Policies > Mail Flow Policies and click Add Policy.

Enter a name and description for the mail flow policy, such as Exchange Outbound.

Under Connection Behavior, select Relay.

Click Submit.

The other options are not valid connection behaviors to properly process the messages, because they

either reject, delay, or accept the messages with content or reputation filters applied.

Reference: [User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway], page 6-2 and page 6-3.

Direct access via web browser requires authentication is the restriction that is in place for end users

accessing the spam quarantine on Cisco Secure Email Gateway appliances. Spam quarantine is a

feature that allows Cisco ESA to store messages that are suspected to be spam and allow end users

or administrators to review them and release or delete them as needed.

End users can access their personal spam quarantine on Cisco ESA either by clicking on a link in a

notification email or by entering their email address and password in a web browser. In both cases,

authentication is required to ensure security and privacy.

The other options are not valid restrictions that are in place for end users accessing the spam

quarantine on Cisco Secure Email Gateway appliances, because they are either not mandatory or not

related to authentication.

Reference: [User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway], page 10-2 and page 10-3.

To ensure that executive messages are originating from legitimate sending addresses, the

administrator must take two steps:

Create an incoming content filter with the Forged Email Detection condition. This will allow the

administrator to detect and block messages that have a forged “From: header” that matches or is

similar to any of the names in a content dictionary.

Create a content dictionary including a list of the names that are being spoofed. This will allow the

administrator to specify the names of the executives that are being targeted by spoofing attacks and

use them in the Forged Email Detection condition. The other options are not relevant or sufficient for

this task. Reference: [Cisco Secure Email Gateway Administrator Guide - Forged Email Detection] and

[Cisco Secure Email Gateway Administrator Guide - Creating Content Dictionaries]