hardMultiple ChoiceObjective-mapped
350-701 Practice Question: An enterprise is deploying a hybrid email…
An enterprise is deploying a hybrid email security solution using Cisco Email Security Appliance (ESA) on-premises and Cisco Cloud Email Security (CES). The organization wants to use the cloud for spam filtering while the on-premises ESA handles DLP and encryption for sensitive data. Inbound emails should be processed by the cloud first, then sent to the on-premises ESA. Which architecture correctly implements this requirement?
⚠ Common exam trap
Cisco often tests the order of processing in hybrid email architectures, and the trap here is that candidates mistakenly think the on-premises ESA should be the first hop (Option C) or that dual MX records can enforce sequential processing (Option B), when in reality the MX record must point to the cloud service to ensure the correct flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MX record → Cisco CES → On-premises ESA (internal mail server)
It places Cisco CES (cloud) first in the email flow to handle spam filtering, then forwards the cleaned messages to the on-premises ESA for DLP and encryption before delivery to the internal mail server. This matches the requirement that inbound emails be processed by the cloud first, then the on-premises ESA, with CES acting as the initial SMTP gateway via MX record.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MX record → On-premises ESA → Internal mail server, with a separate smart host via CES
Why it's wrong here
This does not process inbound email through the cloud.
- ✗
MX record → Dual MX pointing to both CES and ESA
Why it's wrong here
Dual MX records cause email to arrive at either destination, not sequential processing.
- ✗
MX record → On-premises ESA → Cisco CES → Internal mail server
Why it's wrong here
This sends mail to on-premises first, bypassing cloud spam filter, then back to cloud, which is inefficient and not desired.
- ✓
MX record → Cisco CES → On-premises ESA (internal mail server)
Why this is correct
This flow ensures cloud spam filtering first, then DLP/encryption on-premises.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.