350-701 Content Security — Timed 10 Questions

Question 1

A security administrator notices that a significant volume of spam is bypassing the Cisco ESA's anti-spam filters. Upon investigation, they find that the messages have a mid-range SBRS score of 5.0. Which action should the administrator take to improve spam detection?

Accepted Answer

Lower the SBRS threshold to 3.0. The SBRS score ranges from -10 to +10, with negative scores indicating spam. A score of 5.0 is considered likely legitimate. To catch more spam, the administrator should lower the threshold so that messages with scores above a lower value (e.g., 3.0) are treated as spam.

Answer

Change the SBRS score interpretation to positive

Answer

Increase the SBRS threshold to 7.0

Answer

Disable SenderBase reputation checks

Question 2

An organization is deploying Cisco ESA and wants to ensure that outbound emails containing credit card numbers are blocked. The administrator configures a DLP policy to scan for credit card patterns. However, some legitimate emails with credit card numbers are being incorrectly blocked. What is the best approach to reduce false positives while still preventing data leakage?

Accepted Answer

Change the DLP action from 'Block' to 'Confirm with Sender'. Option B is correct because changing the DLP action from 'Block' to 'Confirm with Sender' allows the Cisco ESA to send a notification to the sender when a credit card pattern is detected, asking them to confirm whether the email should be sent. This reduces false positives by giving legitimate senders a chance to override the block, while still preventing accidental data leakage by requiring explicit confirmation. The DLP policy remains active, so unauthorized or unconfirmed outbound emails containing credit card numbers are still stopped.

Answer

Disable the DLP policy for outbound email

Answer

Increase the DLP sensitivity threshold

Answer

Add all senders to a DLP exemption list

Question 3

A Cisco WSA administrator wants to block access to social media sites for all users during work hours. The proxy is deployed in explicit mode. Which policy type should the administrator use to enforce this restriction?

Accepted Answer

Access policy. In explicit proxy mode, the WSA uses access policies to control web traffic based on URL categories. The administrator should create an access policy that identifies social media traffic and sets the action to 'Block'.

Answer

Identity policy

Answer

Routing policy

Answer

Decryption policy

Question 4

Which Cisco content security solution uses DNS to block access to malicious domains and provides cloud-based proxy protection?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that uses DNS to block requests to malicious domains. It also includes a cloud proxy for full URL filtering and threat protection.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Question 5

An organization using Cisco WSA in transparent proxy mode with WCCP redirect notices that some HTTPS traffic is not being decrypted for inspection. The administrator has enabled SSL decryption but certain traffic still bypasses. What is the most likely cause?

Accepted Answer

The SSL decryption policy is not set to decrypt on port 443. In transparent proxy mode, SSL decryption requires that the WSA is positioned in the traffic path (e.g., via WCCP). If decryption is not happening, the WSA may not be intercepting the traffic correctly, often due to the destination port not being included in the decryption policy or the traffic being non-HTTP.

Answer

The clients are not configured to use a proxy

Answer

The web server certificate is self-signed

Answer

The WSA is operating in explicit proxy mode

Question 6

A Cisco ESA administrator is investigating an increase in false positive detections from the outbreak filter. The filter is configured to use TALOS intelligence and has a threshold of 'Medium'. Which action would most effectively reduce false positives while maintaining protection against new outbreaks?

Accepted Answer

Change the threshold to 'High'. The outbreak filter uses TALOS threat intelligence to quarantine suspicious messages. Increasing the threshold to 'High' reduces sensitivity, meaning only messages with strong indicators of maliciousness will be flagged, reducing false positives.

Answer

Change the threshold to 'Low'

Answer

Disable the outbreak filter

Answer

Exempt all internal senders from the filter

Question 7

A company is implementing DMARC for its domain. The administrator wants to instruct receivers to reject emails that fail SPF or DKIM checks. Which DMARC policy should the administrator set?

Accepted Answer

p=reject. DMARC policy options are: none (monitor), quarantine (send to spam), or reject (block). To reject failing messages, the administrator sets p=reject in the DMARC DNS record.

Answer

p=quarantine

Answer

p=none

Answer

p=deny

Question 8

Which Cisco WSA feature allows administrators to control bandwidth usage per user or group by limiting the amount of bandwidth consumed for specific applications?

Accepted Answer

Bandwidth controls. The WSA includes bandwidth controls that can be applied per user/group and per application category, allowing traffic shaping and rate limiting.

Answer

URL filtering

Answer

AVC (Application Visibility and Control)

Answer

Decryption policies

Question 9

A security analyst receives an alert that a user clicked a link in an email that led to a malicious website. The email was allowed by the Cisco ESA because it passed SPF, DKIM, and DMARC checks. Later analysis reveals the email was sent from a compromised account within the same domain. Which type of attack best describes this scenario?

Accepted Answer

Account takeover (BEC). When an attacker compromises a legitimate email account within the organization and uses it to send malicious emails, it is an account takeover attack, which is a form of Business Email Compromise (BEC). Since the email authenticated correctly, it bypassed email authentication checks.

Answer

Malspam

Answer

Spear phishing

Answer

Whaling

Question 10

An organization is using Cisco Firepower NGFW to enforce content filtering. They want to block social media applications like Facebook and Twitter but allow LinkedIn for business purposes. Which feature should be used to differentiate between these applications?

Accepted Answer

Application control with application filters. Firepower NGFW uses application control to identify and block specific applications. By creating a rule that blocks the 'Social Networking' category but then allows 'LinkedIn' specifically (or blocks Facebook and Twitter by application), the administrator can achieve granular control.

Answer

URL filtering based on categories

Answer

Intrusion policy

Answer

TLS server identity discovery