NO.1 Which of the following two RAT entries will accept mail for example.com and all of its

sub-domains? (Choose two.)

A. *@example.com

B. .example.com

C. example.com

D. *@*.example.com

Answer: B,C

NO.2 Refer to the exhibit. Based on the content filter condition menu, which of the following

statements is correct?

A. If the word "secret" is present in the message an action will take place.

B. If the word "secret" is present in either the message body or attachment, an action will take place.

C. If the word "secret" occurs a total of three times in either the message body or attachments, an

action will take place

D. If the ABA routing number is present in either the message body or attachment, an action will

take place.

Answer: C

NO.3 Which option describes when DLP scanning occurs in the email pipeline?

A. Between anti-virus and anti-spam check

B. Immediately after outbreak filters

C. Before anti-spam check

D. After message filters and before content filters

Answer: B

NO.4 In the IronPott C-Series, which of the following control theSMTP conversation? (Choose two.)

A. Outbreak Filters

B. Content Filters

C. IronPort Anti-Spam

D. Message Filters

E. Recipient Access Table

F. Host Access Table

G. Anti-Virus

Answer: E,F

NO.5 During which stage in a mail flow on a Cisco Email Security Appliance does content filtering

occur?

A. Reputation filtering (SBRS) > message filters > antispam > antivirus > content filter > mail policies

B. Reputation filtering (SBRS) > message filters > mail policies > antispam > antivirus > content filter

C. Reputation filtering (SBRS) > message filters > content filter > mail policies > antispam > antivirus

D. Reputation filtering (SBRS) > mail policies > message filters > antispam > antivirus > content filter

Answer: D

NO.6 When configuring CRES, where do you enable read receipts?

A. In the encryption profile

B. In the content filter condition menu

C. In the content filter action menu

D. In the mail policy

Answer: A

NO.7 Which packet capture option filters out only SMTP traffic to and from IP address

209.165.201.10?

A. src=209.165.201.10proto=smtp

B. dst=209.165.201.10 and port=25

C. host 209.165.201.10 and port 25

D. src or dst 209.165.201.10 and proto smtp

Answer: C

NO.8 Refer to the exhibit. Based on the Add Condition menu which of listed file attachments will be

matched? (Choose two.)

A. A .msi attachment that has had its file extension changed to .pdf

B. A .pdf attachment that has had its file extension changed to .exe.

C. A.pdf attachment

D. A .exe attachment.

Answer: B,D