hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A large enterprise recently migrated to Cisco…
A large enterprise recently migrated to Cisco Email Security Appliance (ESA) for inbound email filtering. The security team notices an increasing number of phishing emails that bypass the spam filter. Analysis shows that these emails originate from a legitimate but compromised domain (example-bank.com), use valid DKIM signatures, and have low spam scores due to carefully crafted benign text and embedded images. The team already has SenderBase enabled and uses the default spam threshold. The CEO received a convincing phishing email that led to a credential leak. Which course of action should the security team take to best mitigate this threat without causing significant false positives?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a content filter that detects the domain 'example-bank.com' in the envelope sender and sets the action to 'drop'.
Creating a content filter to detect the specific malicious domain in the envelope sender (MAIL FROM) and applying a 'drop' action directly blocks emails from that compromised domain. This targeted approach minimizes false positives on other domains. Option A is incorrect because increasing the spam threshold may still not catch these low-scoring emails and could increase false positives. Option B is incorrect because graymail filtering targets bulk or newsletter emails, not targeted phishing from a compromised legitimate domain. Option D is incorrect because DMARC with quarantine would only help if the domain were being spoofed; however, these emails are coming from the actual legitimate domain which is compromised, so DMARC would not apply.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the spam threshold to catch lower-scoring emails.
Why it's wrong here
Raising the threshold may increase false positives and might still miss highly tailored emails with low scores.
- ✗
Enable graymail filtering to categorize these emails as bulk suspicious.
Why it's wrong here
Graymail filtering targets subscription-based emails, not targeted phishing from compromised domains.
- ✓
Create a content filter that detects the domain 'example-bank.com' in the envelope sender and sets the action to 'drop'.
Why this is correct
This directly blocks emails from the known malicious domain without affecting other domains, minimizing false positives.
- ✗
Implement DMARC with a quarantine policy for the domain.
Why it's wrong here
DMARC protects against domain spoofing, but the emails are from the actual domain, so DMARC would not block them.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.