mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: A university is using Cisco ESA to manage email…
A university is using Cisco ESA to manage email for 20,000 students and staff. They have implemented anti-spam and anti-virus policies. Recently, the IT helpdesk has been receiving complaints that legitimate emails from external senders (such as admissions notifications) are being marked as spam and quarantined. The administrators check the ESA and find that these emails are being flagged with a spam score above the threshold, but the content appears to be legitimate. The sending domains are not on any blacklist. The ESA is using default anti-spam settings. What should the administrator do to reduce false positives without compromising security?
⚠ Common exam trap
Cisco often tests the distinction between whitelisting (bypassing scanning) and content filters (applying actions after scanning), leading candidates to mistakenly choose a content filter rule that can be exploited or a threshold adjustment that worsens false positives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the legitimate sender domains or IPs to the ESA's whitelist (SenderBase whitelist).
Adding the legitimate sender domains or IPs to the ESA's SenderBase whitelist explicitly bypasses anti-spam scanning for those trusted sources, reducing false positives while maintaining security for all other inbound email. This approach leverages the ESA's reputation-based filtering to allow known good senders without lowering the global spam threshold or disabling protection entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a content filter to allow any email with 'admissions' in the subject.
Why it's wrong here
Not scalable and may allow spam.
- ✗
Disable anti-spam scanning for all inbound email.
Why it's wrong here
Removes protection.
- ✓
Add the legitimate sender domains or IPs to the ESA's whitelist (SenderBase whitelist).
Why this is correct
Whitelist trusted senders.
- ✗
Lower the spam threshold to decrease sensitivity.
Why it's wrong here
Would increase spam detection but also false negatives.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.