Web and email content security is the practice of inspecting and filtering all data that enters or leaves an organisation through web browsers and email systems. For the 350-701 exam, you must understand how these security controls prevent malware, data loss, and phishing attacks before they reach users. This chapter gives you the foundational knowledge to configure and troubleshoot these protection mechanisms in a real network.
Jump to a section
A simple way to picture Content Security: Web and Email
Your company's mailroom is the first line of defence for every piece of mail that arrives. Every letter, box, or package must pass through this central sorting point before it reaches an employee's desk. The mailroom does not blindly forward everything; it inspects each item for obvious dangers, such as packages that leak powder, have no return address, or come from known scam mailing lists. It also applies company rules: personal mail might be returned to sender, and anything marked 'confidential' might be logged before delivery.
Now consider the email that floods your corporate inbox every day. Your web and email security gateway is like that mailroom, but it operates at digital speed. Every incoming email and every visited web page is intercepted, inspected, and either allowed through, blocked, or quarantined. The gateway checks the sender's reputation (like checking a return address against a known-scammer database), scans the content for malicious code (like sniffing a package for chemicals), and enforces company policies (like blocking streaming video sites during work hours).
Just as a mailroom protects the entire office from a single dangerous package, the content security gateway protects the entire corporate network from a single malicious email or compromised webpage. It is the centralised checkpoint that separates safe digital traffic from dangerous cargo.
Content security for web and email is a set of technologies that protect an organisation from threats hidden inside web traffic and email messages. Think of it as a specialised security guard that sits between your internal network and the internet, examining every piece of data that tries to pass through.
To understand why this is necessary, consider what happens without it. An employee opens their email and clicks a link that looks like it comes from their bank. That link takes them to a fake login page that steals their password. Or an employee visits a legitimate website that has been infected with a hidden script that downloads ransomware to their computer. Content security solutions are designed to catch these threats before they cause harm.
There are two main categories of content security: web security and email security.
Web Security
Web security focuses on traffic that travels through the HTTP and HTTPS protocols — the language your browser uses to load web pages. A web security gateway (often called a proxy) sits between users and the internet. Every web request from a user goes to the proxy first. The proxy decides whether to allow or block that request.
Key features of web security include:
URL filtering: The gateway maintains a database of website categories (social media, news, malware, phishing, etc.). It can block entire categories based on company policy. For example, a school might block all gambling sites.
Reputation filtering: Each website and each file download gets a reputation score based on how trustworthy it is. Files from unknown sources or sites with a bad reputation are blocked.
Malware scanning: All downloaded files are scanned for viruses, worms, and other malicious code before they reach the user.
SSL/TLS inspection: Many threats hide inside encrypted HTTPS traffic. The gateway decrypts the traffic, inspects it, then re-encrypts it before sending it to the user. This is sometimes called 'break and inspect'.
Data loss prevention (DLP): The gateway can detect sensitive information (like credit card numbers or patient health data) being sent out via web forms and block it.
Email Security
Email security focuses on messages sent and received using SMTP (Simple Mail Transfer Protocol), the standard protocol for email transmission. An email security gateway sits between your email server and the internet, scanning every message in transit.
Key features of email security include:
Spam filtering: The gateway uses complex algorithms to identify and block unwanted bulk email. It looks at the sender's reputation, the email's content, and the structure of the message.
Phishing protection: Specialised filters identify emails that try to trick users into revealing passwords or financial information. This includes detecting fake login pages and suspicious links.
Malware attachment scanning: All file attachments are scanned for malware before delivery. This includes scanning inside compressed files (like ZIP archives).
Link protection: Some gateways rewrite links in emails to redirect through a cloud-based scanning service. When a user clicks the link, it is checked in real time against current threat intelligence.
Encryption: Email can be encrypted in transit (using TLS) and at rest to protect sensitive content.
Sender authentication: Technologies like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) verify that an email really came from the domain it claims to come from. This prevents spoofing.
How these technologies work together
In a modern organisation, web and email security are often delivered together as part of a unified security platform, sometimes called a Secure Web Gateway (SWG) and a Secure Email Gateway (SEG). These can be physical appliances in your data centre, virtual machines, or cloud-based services like Cisco Secure Web Appliance and Cisco Secure Email Appliance.
The process typically looks like this:
A user sends an email or requests a webpage.
The traffic is redirected to the security gateway (either by configuring the browser or email client, or by routing all traffic through the gateway using network rules).
The gateway inspects the traffic against all enabled security policies.
If the traffic is clean and policy-compliant, it is allowed through. If it is malicious or violates policy, it is blocked, quarantined, or logged for review.
The user receives the cleared content or sees a block page explaining why the request was denied.
Organisations deploy these technologies because the consequences of a single breach are massive: lost data, regulatory fines, downtime, and reputational damage. Web and email are the two most common attack vectors because every employee uses them every day.
Traffic Interception
When a user clicks a link in their browser or sends an email, the traffic is intercepted by the security gateway. This interception can happen by configuring the browser's proxy settings, by redirecting all email traffic through a mail exchanger record (MX) that points to the gateway, or by using network-based redirects like Web Cache Communication Protocol (WCCP). The goal is to force all relevant traffic through the inspection point.
Reputation and Classification
The gateway checks the reputation of the sender (email) or the URL (web). It queries a cloud-based database that assigns a reputation score based on historical behaviour. For example, a URL that was registered yesterday and has no history gets a low score. The gateway also classifies the content into categories: spam, phishing, social media, malware, etc.
Content Inspection and Scanning
The gateway examines the actual content of the email or web page. For email, this includes scanning the subject line, body, and all attachments for malicious patterns. For web traffic, this includes scanning the HTML code, scripts, and downloaded files. Advanced gateways use multiple scanning engines (anti-virus, anti-spyware, and heuristics) to catch polymorphic malware that changes its signature.
Policy Enforcement
After inspection, the gateway applies the organisation's security policies. These policies define what happens to different types of content. For example: 'Block all emails containing credit card numbers', 'Allow social media but block file downloads from social media sites', or 'Quarantine any email with an executable attachment'. The gateway logs the action for auditing.
Action and Delivery
Based on the policy enforcement, the gateway takes one of several actions: allow the traffic through, block it (showing a block page or sending a bounce message), quarantine it for later review, or rewrite the content (such as removing a suspicious link or adding a warning banner). The user receives either the safe content or a notification that the request was denied.
Logging and Reporting
Every decision made by the gateway is logged. These logs are used for incident investigation, compliance reporting, and tuning the security policies. Administrators review quarantine queues daily, run reports on threat trends, and adjust rules based on new vulnerabilities or attack patterns.
A medium-sized law firm, 'Smith and Partners', has 200 employees who send and receive thousands of emails and browse hundreds of websites daily. The firm handles sensitive client documents, including contract negotiations and personal financial data. They need to protect against phishing attacks that could trick lawyers into revealing confidential information.
An IT security administrator named Priya is responsible for configuring their content security solution. She uses Cisco Secure Email Appliance (SEA) and Cisco Secure Web Appliance (SWA), which are physical servers installed in the firm's server room.
Here is a typical day for Priya:
Morning: Reviewing quarantine reports
Priya logs into the central management console for both appliances. She checks the quarantine summary for the last 24 hours. The email quarantine shows 47 messages that were flagged as suspicious. She quickly skims through them: most are obvious spam from unknown senders, but two emails catch her eye because they claim to be from a well-known bank and ask the recipient to 'verify their account'. She marks both as phishing and updates the filter rules to block any similar messages from that sender domain.
The web quarantine shows 12 blocked file downloads. One is a PDF from a website that the appliance flagged as 'newly registered' and 'low reputation'. Priya reviews the file in a sandbox environment — an isolated virtual machine that safely opens the file to see if it behaves maliciously. The sandbox reports that the PDF attempts to execute a script on open. Priya confirms the block.
Midday: Investigating a user report
A lawyer calls Priya, saying they received a strange email from a colleague asking for an urgent wire transfer. Priya looks up the email in the appliance logs. She sees that the appliance did not block it because it passed all authentication checks (SPF, DKIM, and DMARC all look valid). However, the email address displayed in the 'From' field is not quite right — it uses a similar but different domain (smith-parners.com instead of smithandpartners.com).
Priya realises this is a 'spear phishing' attack specifically targeting their firm. She creates a new content filter rule that blocks any email from the fraudulent domain and adds a custom warning banner to all external emails that says 'This message is from outside the organisation'.
Afternoon: Tuning web security policies
The managing partner asks Priya to allow access to a cloud-based document review tool that some lawyers need for a case. Priya navigates to the SWA's URL filtering policy. She adds the tool's domain to a 'whitelist' (an allowed list) so it is not blocked. She also checks the tool's category in the reputation database to ensure it is not classified under 'unproven software' which would still trigger a block.
She then adjusts the SSL inspection settings. One lawyer needs to access a healthcare portal that uses a custom certificate. Priya configures the SWA to exclude that specific domain from SSL inspection, because the portal's certificate would otherwise be flagged as untrusted by the appliance.
End of day: Reporting
Priya runs a weekly report showing how many threats the appliances blocked, how many emails were classified as spam, and how much bandwidth was saved by blocking streaming video during work hours. She sends this report to her manager to demonstrate the value of the security investment.
The key actions an IT professional performs with content security include:
Configuring policies for URL filtering, malware scanning, and DLP.
Managing quarantine queues: reviewing, releasing, or deleting quarantined messages.
Tuning anti-spam and anti-phishing rules based on emerging threats.
Investigating security incidents reported by users.
Updating appliance firmware and threat intelligence feeds.
Performing SSL certificate management for the 'break and inspect' functionality.
Generating compliance reports for auditors.
Without these daily tasks, the firm would be exposed to significant risk from a single compromised email or malicious website.
The 350-701 exam tests your understanding of content security concepts, not your knowledge of specific product interfaces. Cisco expects you to understand what each technology does, why it exists, and how the pieces fit together.
Here are the specific areas you must master:
Key concepts tested
The difference between a Secure Web Gateway (SWG) and a Secure Email Gateway (SEG). The exam asks you to identify scenarios where each is appropriate.
The purpose of URL filtering categories and reputation scores. Be able to explain how a URL is categorised and why reputation matters.
The three email authentication standards: SPF, DKIM, and DMARC. Know what each one does, how they work together, and what happens if one fails.
The concept of 'break and inspect' for SSL/TLS traffic. Know the advantages (inspecting encrypted threats) and disadvantages (privacy concerns, certificate management overhead).
The difference between inbound and outbound scanning. Inbound protects against incoming threats; outbound (DLP) protects against data loss.
Types of malware commonly delivered via email: ransomware, trojans, worms, and credential harvesters.
The role of sandboxing in email security: detonating suspicious attachments in an isolated environment.
Common exam traps
Confusing 'spam' with 'phishing'. Spam is unwanted bulk email; phishing is a targeted attempt to steal information. The exam might present a grey-area scenario and ask you to choose the correct classification.
Assuming that HTTPS traffic is always safe. The exam stresses that threats can hide in encrypted traffic, which is why SSL inspection exists.
Thinking that email authentication (SPF, DKIM, DMARC) prevents all email-based attacks. These only verify the sender's domain, not whether the content is malicious.
Overlooking the need for both web and email security. Some questions present a scenario where only one is deployed and ask you to identify the gap.
Forgetting that DLP can work on both web traffic and email. The exam might ask which capability applies to a specific data-loss scenario.
What to memorise
The definition and acronym for each email authentication standard.
The three stages of email processing: spam filtering, malware scanning, and policy enforcement.
The difference between a 'proxy' (which intercepts all traffic) and 'explicit proxy' (where the browser is manually configured).
The default action for the Cisco Secure Email Appliance when a message is suspected to contain malware: quarantine.
The purpose of 'content filters' in email security: they allow custom rules based on message properties (e.g., subject line, attachment type, recipient).
Question types
Multiple-choice questions asking you to pick the correct technology for a given scenario.
'Drag and drop' where you match a security concept to its description.
Scenarios where a security incident occurs, and you must identify which component failed or which policy was missing.
The exam does not require you to memorise Cisco CLI commands or specific model numbers. Focus on concepts, protocols, and deployment motivations.
Web and email security gateways inspect all traffic for malware, phishing, and policy violations before content reaches users.
Email authentication using SPF, DKIM, and DMARC prevents attackers from spoofing your organisation's domain in email communications.
SSL/TLS inspection is critical because threats hide inside encrypted traffic, and without it your security controls are blind to the majority of modern attacks.
Data loss prevention (DLP) works on both outbound email and web traffic to stop sensitive data from leaving the organisation.
A Secure Web Gateway (SWG) focuses on HTTP/HTTPS traffic, while a Secure Email Gateway (SEG) focuses on SMTP traffic, but they are often deployed together.
Sandboxing detonates suspicious file attachments in an isolated environment to observe their behaviour before delivering them to users.
Content security is not a one-time setup; it requires continuous monitoring, policy tuning, and threat intelligence updates to remain effective.
These come up on the exam all the time. Here's how to tell them apart.
Secure Web Gateway (SWG)
Inspects HTTP and HTTPS web traffic
Focuses on URL filtering, web reputation, and file download scanning
Can be deployed as a forward proxy or transparent proxy
Secure Email Gateway (SEG)
Inspects SMTP, SMTPS, and IMAP email traffic
Focuses on spam filtering, phishing detection, and attachment scanning
Typically deployed as a mail transfer agent (MTA) between the internet and the internal mail server
SPF (Sender Policy Framework)
Uses DNS TXT records to list authorised mail servers for a domain
Validates the envelope sender (MAIL FROM) address
Can fail for legitimate forwarded email due to path changes
DKIM (DomainKeys Identified Mail)
Uses a digital signature added to the email headers
Validates the message body and attachments have not been altered
Survives forwarding because the signature is tied to the original content, not the delivery path
Inbound Scanning
Focuses on threats arriving from external senders
Goal is to block malware, spam, and phishing
Rules are based on known threat signatures and reputation
Outbound Scanning (DLP)
Focuses on data leaving the organisation
Goal is to prevent data loss and compliance violations
Rules are based on patterns of sensitive data (credit cards, health records, intellectual property)
URL Filtering
Blocks or allows websites based on their categories (social media, gambling, malware)
Categories are predefined by the security vendor
Does not consider the age or history of the specific website
Reputation Filtering
Blocks or allows websites based on a numerical score of trustworthiness
Score is calculated from factors like site age, domain registration info, and observed behaviour
Can block sites that are categorised as 'none' or 'unknown' if they have a bad score
Mistake
Email security gateways only need to scan incoming messages.
Correct
Email security gateways must scan both inbound and outbound messages. Outbound scanning prevents data loss (DLP) and stops infected machines inside the network from sending malware to external recipients.
Beginners often think of security as only stopping external attacks, forgetting that threats can originate from inside the network through compromised devices.
Mistake
SSL/TLS inspection is optional and rarely needed because HTTPS is already secure.
Correct
SSL/TLS inspection is essential because malware and phishing content can be hidden inside encrypted connections. If you do not inspect HTTPS traffic, you are blind to a large percentage of modern web threats.
People trust the padlock icon in the browser, not realising that encryption only protects data in transit from eavesdropping, not from being malicious.
Mistake
SPF, DKIM, and DMARC are interchangeable authentication methods.
Correct
SPF, DKIM, and DMARC serve different but complementary roles. SPF verifies which mail servers are authorised to send email for a domain. DKIM adds a digital signature to verify message integrity. DMARC tells receiving servers how to handle messages that fail SPF or DKIM checks.
The acronyms sound similar and all relate to email authentication, but beginners lump them together without understanding the distinct function of each.
Mistake
Blocking all attachments with executable file types (like .exe) is sufficient to stop email-borne malware.
Correct
Malware can be delivered in many file types that users expect to be safe, such as PDFs, Office documents with macros, and even compressed archives like ZIP files. A comprehensive email security solution must scan all file types and use advanced techniques like sandboxing.
This misconception stems from a traditional belief that only executable files can run code. Modern malware often uses script macros or exploits vulnerabilities in document viewers.
Mistake
Content security only protects against external threats, so it does not matter if employees access malicious sites on their personal devices.
Correct
Content security protects the corporate network. If an employee uses a personal device to access a malicious site and then connects to the corporate network (for example, through VPN), the device can introduce malware. Many solutions now include remote browsing isolation or client-side security to address this.
People often separate 'corporate' and 'personal' devices in their minds, but in practice, network boundaries are blurred by remote work and BYOD policies.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A firewall controls traffic based on IP addresses and port numbers, allowing or blocking connections at the network level. A proxy (or web security gateway) operates at the application layer, inspecting the actual content of HTTP/HTTPS requests, and can make decisions based on the URL, file type, or content category.
Yes. Anti-virus software on endpoints only catches threats that reach the user's machine and are detected by that specific software. An email security gateway stops threats before they ever reach the user, blocks mass spam, and provides centralised policy control, logging, and quarantine. It is a defence-in-depth layer that complements endpoint protection.
If an email fails SPF (meaning it came from an unauthorised server) but passes DKIM (the digital signature is valid), the DMARC policy for the domain determines what happens. The DMARC policy might instruct the receiving server to quarantine the message or reject it. This scenario often occurs with legitimate email forwarding services, which can break SPF validation.
SSL/TLS inspection using 'break and inspect' works by presenting a certificate signed by a trusted Certificate Authority (CA) to the user's browser. This requires the organisation's CA certificate to be installed on all managed devices. Some websites use certificate pinning, which can cause them to fail under SSL inspection. Administrators can bypass inspection for specific compliant domains.
A sandbox is an isolated virtual environment that opens suspicious file attachments to observe their behaviour. If the file tries to modify system files, contact a command-and-control server, or encrypt data, the sandbox detects this malicious activity and prevents the file from being delivered to the recipient.
The gateway uses URL categorisation and reputation scoring. It may block a site because it falls into a blocked category (like 'peer-to-peer' or 'adult') or because the site has a low reputation (newly registered, known to host malware). Your home computer likely does not have these corporate policies applied.
You've finished Content Security: Web and Email. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?