350-701 Question 193

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  REJECT. Connection is initially accepted, but the client attempting to connect gets a 4XX or 5XX SMTP status code. No email is accepted. TCPREFUSE. Connection is refused at the TCP level. This question is anyway confusing, but the issue is that if we use the action REJECT we are saying that at least the TCP Session will be accepted, we will block then the SMTP session if the REJECT action.

• Chose B1

  Why the Others Are Incorrect A. Reset the TCP connection ❌ Used for IP-based blocking, not domain-based identity C. Drop malicious emails ❌ Happens after the email is received D. Quarantine malicious emails ❌ Also post-acceptance

• Chose B2

  I'd go for B. the question is PREVENT, a reset, resets the connecton (connection already took place) read this: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html You can configure your Email Security Appliance (ESA) to restrict connections by adding any of these items to Sender Groups which use Mail Flow Policies: IP range Specific host or domain name SenderBase Reputation Service (SBRS) "organization" classification SBRS score range DNS List query response Each Mail Flow Policy has an access rule, such as ACCEPT, REJECT, RELAY, CONTINUE, and TCPREFUSE. A host that attempts to establish a connection to your ESA and matches a Sender Group using a TCPREFUSE access rule is not allowed to connect to your ESA. From the standpoint of the sending server, it will appear as if your server is unavailable. Most MTAs will retry frequently in this case, which will create more traffic then answering once with a clear hard bounce, for example, REJECT.