The scenario describes implementing DomainKeys Identified Mail (DKIM), a method that uses a digital signature to prove an email was sent and authorized by the owner of a specific domain. On a Cisco Secure Email Gateway, configuring DKIM signing involves two primary components. First, a Public/Private keypair is required; the gateway uses the private key to cryptographically sign outgoing messages. Second, a Domain signing profile must be configured. This profile associates a domain name with the specific private key and a selector, instructing the appliance on how to apply the DKIM signature to emails originating from that domain.

A. DMARC verification profile: This is used to check the authenticity of incoming emails based on SPF and DKIM results, not for signing outgoing mail.

B. SPF record: This is a DNS record used by receiving servers to verify the sending server's IP address; it does not involve creating a digital signature on the email itself.

E. PKI certificate: DKIM uses a raw public/private keypair published in DNS. PKI certificates (X.509) are used for other technologies like S/MIME or TLS, not for domain-level DKIM signing.

1. Cisco Secure Email Gateway Configuration Guide

14.0

"Email Authentication" chapter

"Configuring the System to Sign Outgoing Messages Using DKIM" section.

This document outlines the precise procedure. Step 1 is "Create signing keys

" which corresponds to the Public/Private keypair. Step 2 is "Create a domain profile for each domain for which you want to sign messages

" which corresponds to the Domain signing profile. The guide states

"A domain profile specifies the domain name

the selector

and the private key to use when signing messages from that domain." This directly supports the selection of C and D.

2. Cisco Secure Email Gateway Configuration Guide

14.0

"Email Authentication" chapter

"About DomainKeys Identified Mail (DKIM) Signing" section.

This section explains the mechanism: "DKIM signing adds a digital signature to messages

using a private key. The corresponding public key is published in the DNS." This confirms the fundamental role of the Public/Private keypair (Option C) in the DKIM process.

3. Cisco Secure Email Gateway Configuration Guide

14.0

"Email Authentication" chapter

"About Domain-based Message Authentication

Reporting

and Conformance (DMARC)" section.

This section clarifies that DMARC is used for "DMARC verification for incoming mail

" confirming that a DMARC verification profile (Option A) is for inbound mail processing

not outbound signing.

Content filters are rule-based mechanisms used to enforce security policies. The fundamental structure of any content filter rule consists of two primary components. First, one or more conditions are defined to specify the criteria that the traffic (e.g., an email message or web request) must meet to trigger the rule. Second, one or more actions are specified to define the enforcement that will be taken when the conditions are met. For example, a condition could be "attachment file type is .exe," and the corresponding action could be "quarantine the message."

B. subject: The 'subject' is a specific attribute that can be used within a condition; it is not a primary structural component of the filter itself.

C. content: 'Content' is the data that a condition evaluates. The 'condition' is the formal component of the rule that performs this evaluation.

E. policies: Policies are higher-level constructs that use content filters. A content filter is a component of a mail or web policy, not the other way around.

1. Cisco

"AsyncOS 15.0 for Email Security User Guide - GD (General Deployment)" (2023-Jan-23). In the chapter "Using Content Filters to Enforce Email Policies

" the section "About Content Filters" states: "Content filters are composed of one or more rules. Each rule is composed of one or more conditions and one or more actions." (Page 289)

2. Cisco

"AsyncOS 14.0 for Cisco Web Security Appliances User Guide" (2021-May-18). The chapter "Controlling Web Traffic Using Access Policies" describes the policy structure: "Each access policy rule has two parts: The criteria that a transaction must match... The action that the Web Security appliance applies to matching transactions." This directly parallels the condition/action model. (Page 208)

To mitigate the processing load from messages sent to invalid recipients, the Cisco Secure Email Gateway uses LDAP for recipient verification. This is a two-step process. First, an LDAP server profile must be created, which defines the connection details for the external directory server (e.g., IP address, port, base DN, bind credentials). Second, this profile is used to configure an LDAP query on the listener's Recipient Access Table (RAT). This enables the gateway to query the LDAP server during the SMTP RCPT TO transaction and reject connections for non-existent recipients before accepting the full message, thereby saving system resources.

A. Enable external LDAP authentication: "Authentication" verifies user credentials (username/password). The task is recipient validation (checking if an address exists), which is a different function.

D. Enable LDAP authentication on a listener: This is incorrect for the same reason as option A. The term "authentication" is not precise for recipient validation.

E. Configure incoming mail policy to query LDAP server: Mail policies are processed after the gateway accepts the message. Rejecting at the listener level is far more efficient for handling invalid recipients.

1. Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0: In the "Using LDAP Queries" chapter

the guide states

"To use LDAP queries

you must first create an LDAP server profile." This supports option C.

Reference: Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0

Chapter: Using LDAP Queries

Section: Creating an LDAP Server Profile.

2. Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0: The same guide explains how to use the created profile: "You can configure listeners to query an LDAP server to determine whether or not a recipient address is valid." This is configured in the Recipient Access Table (RAT). This supports option B.

Reference: Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0

Chapter: Using LDAP Queries

Section: Using an LDAP Query to Accept or Reject Connections to the Listener.

3. Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0: The documentation distinguishes between different uses of LDAP. LDAP for authentication is described for functions like end-user quarantine access

which is separate from recipient validation on a listener. This clarifies why options A and D are incorrect.

Reference: Cisco Secure Email Gateway Configuration Guide

AsyncOS 15.0

Chapter: System Administration

Section: End-User Quarantine Access.

Implementing undesirable URL protection on a Cisco Email Security Appliance (ESA) requires the integration of two specific security services. First, Anti-Spam scanning (C) must be enabled, as the anti-spam engine is responsible for scanning the message body and headers to identify URLs. Once identified, these URLs are passed to the URL filtering service. Second, Outbreak Filters (A) must be enabled to provide advanced, real-time protection. Outbreak Filters checks URLs against reputation data and can rewrite them, redirecting user clicks through a Cisco security proxy for analysis, which is a core component of protecting against malicious and undesirable links.

B. Enable email relay: This is a fundamental function for the appliance to process any mail, not a specific prerequisite for the URL protection feature itself.

D. Enable port bouncing: This is an unrelated network-level technique and not a configurable prerequisite for a security service within the Cisco ESA.

E. Enable antivirus scanning: While often used in conjunction, the antivirus engine is a separate component focused on file attachments and is not a direct dependency for URL filtering.

1. Cisco AsyncOS 14.0 for Email Security User Guide

Chapter: "URL Filtering"

Section: "Overview of URL Filtering". The documentation states

"URL filtering is integrated with the anti-spam scanning engine." This directly confirms that Anti-Spam scanning is a prerequisite.

2. Cisco AsyncOS 14.0 for Email Security User Guide

Chapter: "Protecting Against Viruses

Malware

and Other Threats"

Section: "How Outbreak Filters Work". This section details the URL rewriting and analysis function: "Outbreak Filters can rewrite URLs in messages... When the user clicks the rewritten URL

the Cisco Web Security Proxy is contacted." This functionality is central to undesirable URL protection

making Outbreak Filters a necessary component.

3. Cisco Email Security Appliance Configuration Guide

Release 12.0

Chapter: "Configuring URL Filtering"

Section: "Enabling and Configuring URL Filtering". The guide explicitly lists as a prerequisite: "Before you begin: Enable Anti-Spam scanning on the appliance." This provides direct evidence for the requirement of Anti-Spam.

Regional scanning is a security feature that applies different mail flow policies based on the geographical origin of an email. This feature provides the most significant security improvement when a clear baseline of trusted traffic can be established. In the scenario where most of an organization's legitimate email originates from a specific, known region, an administrator can create a permissive policy for that trusted region. Consequently, a much more aggressive anti-spam policy (e.g., throttling, more stringent scanning, or outright blocking) can be applied to all other regions. This strategic approach holistically tightens the overall security posture by minimizing the attack surface from large, untrusted geographical areas, making it a more robust and resilient policy than one that simply reacts to a single attack's origin.

A: This is a valid but tactical response. A policy targeting only one country is less comprehensive and can be easily bypassed by an attacker switching their country of origin.

B: This is an example of a regional policy, but it is very broad. A more granular policy based on specific trusted/untrusted regions is generally more effective and manageable.

C: This scenario would make aggressive regional scanning counter-productive. If most legitimate email is international, applying stricter rules to it would likely disrupt business operations due to high false positives.

1. Cisco Email Security Appliance Best Practices

Release 14.0: This guide outlines strategies for configuring mail flow policies. It states

"The default mail flow policies are configured with a global perspective in mind. However

every network is different. You may need to adjust the mail flow policies to be more aggressive or more permissive to suit your organization’s tolerance for spam. For example

if your organization only does business within the United States

you can be more aggressive on mail coming from other countries." This directly supports the principle of identifying a trusted region (where you do business) and applying stricter policies elsewhere

as described in option D.

2. Cisco AsyncOS 15.0 for Email Security User Guide - GD (General Deployment): In the "Controlling Sender and Recipient Domains" chapter

the section on "Host Access Table (HAT) Overview" describes how the HAT is the first line of defense

controlling which hosts can connect to the listener. Policies are applied to Sender Groups

which can be defined by geographic location. This mechanism allows for the strategy in option D: creating a sender group for a trusted region with a permissive mail policy (e.g.

ACCEPTED) and placing all others in a more restrictive group (e.g.

SUSPECTLIST or a custom group with aggressive filtering). This demonstrates the technical implementation of the strategy.

The altsrchost command is the most direct and appropriate method for this task. It is used to configure the Sender-Based Routing table on the Cisco Email Security Appliance (ESA). This feature is specifically designed to route outbound email to a designated virtual gateway based on the envelope sender's address. This provides a flexible and centrally managed way to control delivery paths for specific senders or domains, which can be considered "flagged" for special routing. While message filters can also achieve this, altsrchost is the dedicated routing feature for this purpose, making it the most precise and standard method.

A. Set up the interface group with the flag: Interface groups are used to bundle network interfaces for high availability or load distribution, not for conditional routing of individual messages based on flags.

C. Map the envelope sender address to the host: This describes the function of Sender-Based Routing, but it is not the method an engineer uses. The altsrchost command is the specific action taken to create this mapping.

D. Apply a filter on the message: While a message filter using the alt-src-host() action is highly flexible, its primary purpose is policy enforcement. Using the dedicated routing feature (altsrchost) is the more direct and standard practice for sender-based delivery control.

1. Cisco AsyncOS 14.0 for Email Security User Guide

Chapter: "Routing and Delivering Mail"

Section: "Sender-Based Routing".

Quote: "Sender-based routing allows you to specify which virtual gateway to use for delivering mail based on the sender’s address as specified in the envelope. You can use sender-based routing to route mail from specific senders to a smarthost for archiving or to route mail from certain domains through a particular Virtual Gateway address." This section details the use of the altsrchost table (managed by the altsrchost command) as the primary feature for this function.

2. Cisco AsyncOS 14.0 for Email Security User Guide

Chapter: "Using Message Filters to Enforce Email Policies"

Section: "Message Actions"

Subsection: "Control Actions".

Reference: This section describes the alt-src-host() action. The context of the entire chapter is policy enforcement

distinguishing its purpose from the core routing functionality described in the "Routing and Delivering Mail" chapter. This supports the choice of the dedicated routing feature (altsrchost) for a routing task.

3. Cisco Content Security Virtual Appliance Installation Guide

Section: "Virtual Gateway".

Reference: This document defines a Virtual Gateway as a combination of an IP interface and a hostname on the appliance used for mail delivery. The altsrchost command or alt-src-host() filter action directs mail to one of these configured Virtual Gateways.

If you store user information within LDAP directories in your network infrastructure you can

configure the appliance to query your LDAP servers to accept, route, and authenticate messages.

https://www.cisco.com/c/en/us/td/docs/security/esa/esa110/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_011010.html

Reference:

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/

b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_011010.html

On the Cisco Email Security Appliance (ESA) Command-Line Interface (CLI), the filters command is used to manage message filters. To change the status of an existing filter, you must first enter the message filter configuration context by typing filters. Within this context, the set subcommand is used to modify a filter's active status. The correct syntax is set , where is 1 for active and 0 for inactive. Therefore, to activate filter number 2, the command is set 2 1.

A: The edit subcommand is used to modify the conditions and actions within a filter's rules, not to toggle its active status.

B: modify is not a valid subcommand within the filters context on the ESA CLI. Additionally, All would be incorrect as the goal is to modify a specific filter.

C: The detail subcommand is a view-only command used to display the detailed configuration of a specific filter; it cannot be used to make changes.

1. Cisco

"CLI Reference Guide for AsyncOS 14.0 for Email Security"

Section: Mail Policies Commands -> filters

Details: The guide documents the subcommands available within the filters context. It specifies the set subcommand with the syntax set

stating

"Sets the active status of a filter. Use 1 for active and 0 for inactive." This directly supports the use of set 2 1 to activate the second filter. The guide also shows that edit is for changing filter rules and detail is for viewing them

confirming options A and C are incorrect. The command modify is not listed as a valid subcommand.

DomainKeys Identified Mail (DKIM) uses public-key cryptography to sign email messages. The private key is kept secret on the sending mail server, while the corresponding public key must be made publicly available for receiving servers to use for verification. The standard mechanism for publishing this public key is within a DNS TXT (Text) record. The record is created at a specific hostname, which includes a "selector" and the domainkey subdomain (e.g., selector.domainkey.example.com), allowing mail receivers to query DNS, retrieve the key, and validate the email's signature.

A. AAAA record: Incorrect. This record maps a hostname to an IPv6 address and is used for network routing, not for storing cryptographic keys.

B. PTR record: Incorrect. This record is used for reverse DNS lookups, mapping an IP address back to a hostname, primarily for verification and logging.

D. MX record: Incorrect. This record specifies the mail exchange servers responsible for receiving email for a domain; it is fundamental to email routing.

1. Cisco

"AsyncOS 14.0 for Email Security Configuration Guide - GD (General Deployment)": In the chapter "Configuring DomainKeys Identified Mail (DKIM) Signing

" the section "Publishing the Public Key to DNS" states

"After you generate the public-private key pair

you must publish the public key to a publicly-accessible DNS server. You publish the public key by creating a TXT record for the domain."

2. Cisco

"Email Authentication Best Practices: SPF

DKIM

and DMARC": This document explains

"The public key is published in DNS as a TXT record. When a receiving mail server gets an email from your domain

it will perform a DNS lookup to retrieve the public key TXT record."

3. Internet Engineering Task Force (IETF)

RFC 6376

"DomainKeys Identified Mail (DKIM) Signatures": The official standard for DKIM. Section 3.6.2.1

"Record Syntax

" specifies

"The public key is stored in a TXT Resource Record (RR) in the DNS." This is the foundational protocol document.

The scenario describes a classic Directory Harvest Attack (DHA), where an attacker attempts to discover valid email addresses by sending messages to a large number of potential recipients. The log entry "550 Too many invalid recipients" is a direct indicator that the mail gateway is rejecting connections after a certain threshold of invalid recipient lookups has been reached. The Directory Harvest Attack Prevention (DHAP) feature on a Cisco Email Security Appliance (ESA) is specifically designed to detect and mitigate this activity by monitoring the number of invalid recipients from a single connecting host and then throttling or blocking the connection.

B. SBRS: SenderBase Reputation Score is a general IP reputation system. While it can block poor-reputation senders, it does not specifically target the behavior of probing for many invalid recipients.

C. LDAP: Lightweight Directory Access Protocol is the directory service being queried. It is the target of the attack, not the security feature used to prevent it.

D. SMTP: Simple Mail Transfer Protocol is the protocol used to initiate the recipient validation attempts. It is the attack vector, not the protective mechanism.

1. Cisco Email Security Appliance Configuration Guide

15.0

"Mail Policies" Chapter

"Preventing Directory Harvest Attacks" Section. This section states

"A directory harvest attack is an attempt to find valid email addresses at a domain by sending a large number of messages to addresses that may or may not exist... You can configure the security appliance to detect and prevent directory harvest attacks."

2. Cisco Email Security Appliance Best Practices

Tips

and Tricks

"Directory Harvest Attack Prevention (DHAP)" Section. This document explains

"DHAP is a feature on the ESA that is used to prevent spammers from harvesting a corporate directory... The ESA will keep track of how many invalid recipients have been seen from a particular sending IP address... and will return a 550 'Invalid Recipient' SMTP response."

3. Cisco Content Security Management Appliance Configuration Guide

11.1

"Email" Chapter

"Configuring Recipient Access Table (RAT)" Section. This guide details how DHAP works in conjunction with the Recipient Access Table (RAT) and LDAP queries. It confirms that DHAP is the feature that acts on the results of these queries to prevent attacks.