By modifying the mail policies, specifically the recipient matching criteria, you can ensure that email

recipients do not match multiple policies simultaneously. When recipients in the email message

belong to different domains (e.g., cisco.com and test.com), it can result in multiple policies being

triggered simultaneously, leading to inconsistent delivery of emails with attachments.

DLP is for outgoing mail only and not relevant to incoming mail.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/esa/esa120/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011001.html

one of the steps to accept mail for additional internal domains on the Cisco ESA is to choose Network

> SMTP Routes and enter the new domain and the corresponding destination host IP address1. This

can also be done using the smtproutes command in the CLI1. The other commands (deliveryconfig,

dsestconf, and altrchost) are not related to this task.

Message Handling Settings: Repaired Message Handling Messages are considered repaired if the message was completely scanned and all viruses have been repaired or removed. These messages will be delivered as is. Encrypted Message Handling Messages are considered encrypted if the engine is unable to finish the scan due to an encrypted or protected field in the message. Messages that are marked encrypted may also be repaired. Unscannable Message Handling Messages are considered unscannable if a scanning timeout value has been reached, or the engine becomes unavailable due to an internal error. Messages that are marked unscannable may also be repaired. Virus Infected Message Handling The system may be unable to drop the attachment or completely repair a message. In these cases, you can configure how the system handles messages that could still contain viruses. https://www.cisco.com/c/en/us/td/docs/security/esa/esa120/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01011.html#con_1132282

Non-final actions are actions that do not terminate the message filter evaluation, such as adding

headers, setting variables, logging, etc. Final actions are actions that end the message filter

evaluation and determine the fate of the message, such as accept, drop, bounce, quarantine, etc.

Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 3-4.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/

b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.html

Cisco Talos is a cloud service that provides a reputation verdict for email messages based on the

sender domain and other attributes such as IP address, sender behavior, message content, and

attachment analysis. Cisco Talos is integrated with Cisco Secure Email Gateway and provides real-

time threat intelligence and protection against spam, phishing, malware, and other email-borne

threats.

The other options are not valid because:

A. Cisco AppDynamics is a cloud service that provides application performance monitoring and

optimization for enterprise applications. It does not provide reputation verdicts for email messages.

B. Cisco Secure Email Threat Defense is a cloud service that provides visibility and remediation

capabilities for email threats detected by Cisco Secure Email Gateway. It does not provide reputation

verdicts for email messages.

C. Cisco Secure Cloud Analytics is a cloud service that provides network visibility and threat detection

for cloud environments. It does not provide reputation verdicts for email messages.

A policy quarantine is a type of quarantine that allows Cisco ESA to store messages that match

certain criteria, such as virus, spam, or DLP verdicts, for further review or release by an administrator

or an end user.

A scenario that prevents a message from being sent to the quarantine as an action in the scan

behavior on Cisco ESA is when a policy quarantine is missing, which means that no policy quarantine

has been created or enabled on Cisco ESA.

The other options do not prevent a message from being sent to the quarantine as an action in the

scan behavior on Cisco ESA.

Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-2 and page 10-3.

Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118136qanda-esa-00.html

You can use the SMTP route feature on Cisco ESA to specify how messages for a specific domain are

routed to their destination. You can modify the SMTP route for the domain abc.com and change the

IP address to 192.168.1.10 to ensure that messages are delivered correctly3. Reference = Securing

Email with Cisco Email Security Appliance (SESA) v3.1

Spam Quarantine Alias Consolidation Query is a type of query that must be configured when setting

up the Spam Quarantine while merging notifications on Cisco ESA. This query allows Cisco ESA to

consolidate multiple email addresses that belong to the same end user into one entry in the Spam

Quarantine, and send only one notification email to that end user with all the quarantined messages

for all their email addresses.

Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-10.

The appliance enforces your organization’s policies for messages sent to and from your users through

the use of mail policies. These are sets of rules that specify the types of suspect, sensitive, or

malicious content that your organization may not want entering or leaving your network. This

content may include:

-spam

-legitimate marketing messages

-graymail

-viruses

-phishing and other targeted mail attacks

-confidential corporate data

-personally identifiable information

https://www.cisco.com/c/en/us/td/docs/security/esa/esa111/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01001.html?bookSearch=t

rue

End user safelist is a feature that allows end users to specify email addresses or domains that they

want to receive messages from, regardless of the spam verdict or action assigned by Cisco ESA.

Messages from senders on the end user safelist are delivered to the end user’s inbox without any

spam filtering.

Reference: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 10-13.