300-720 · Question #156
A company has recently updated their security policy and now wants to drop all email messages larger than 100 MB coming from external sources. The Cisco Secure Email Gateway is LDAP integrated and…
The correct answer is A. if (mail-from-group == 'Employees') and (body-size > "100M") {drop()}. The filter rule configured to drop messages larger than 100 MB from the 'Employees' group effectively prevents internal users from sending oversized emails.
Question
A company has recently updated their security policy and now wants to drop all email messages larger than 100 MB coming from external sources. The Cisco Secure Email Gateway is LDAP integrated and all employee accounts are in the group "Employees". Which filter rule configuration provides the desired outcome?
Options
- Aif (mail-from-group == 'Employees') and (body-size > "100M") {drop()}
- Bif (mail-from-group != 'Employees') and (body-size > 100M) {drop();}
- Cif (mail-from-group == 'Employees') and (body-size > 100M) {bounce();}
- Dif ('mail-from-group != Employees') and (body-size > 100M) {drop();}
How the community answered
(42 responses)- A83% (35)
- B10% (4)
- C2% (1)
- D5% (2)
Why each option
The filter rule configured to drop messages larger than 100 MB from the 'Employees' group effectively prevents internal users from sending oversized emails.
The filter `if (mail-from-group == 'Employees') and (body-size > "100M") {{drop()}}` targets messages originating from internal employees (identified by the 'Employees' LDAP group) that exceed a 100 MB body size. This configuration is suitable for a security policy aimed at preventing large data outflow from internal sources to external destinations, effectively dropping such messages before they leave the gateway.
This rule `(mail-from-group != 'Employees')` would apply to non-employees, which would include external senders for inbound mail, not internal employees sending outbound mail.
Concept tested: Cisco ESA content filter outbound size control
Source: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100.html#con_1143899
Topics
Community Discussion
No community discussion yet for this question.