Drag and Drop Question Drag and drop the actions from the left into the sequence on the right to configure directory harvest prevention in Cisco Secure Email Gateway. Answer:

Question

Exhibit

Answer Area

Explanation

This question tests the ability to correctly sequence the configuration steps for Directory Harvest Prevention (DHP) using LDAP acceptance queries on a Cisco Secure Email Gateway.

Approach. The correct sequence for configuring directory harvest prevention in Cisco Secure Email Gateway using LDAP acceptance queries is as follows:

1. Step 1: Configure an LDAP server profile. This is the foundational step. Before the Cisco Secure Email Gateway (ESA) can perform any LDAP queries, it must be configured with the details of the LDAP server, including its IP address, port, authentication credentials, and search base. This profile defines 'where' and 'how' to connect to the directory.

2. Step 2: Enable LDAP acceptance queries. Once the connectivity to the LDAP server is defined, the next step is to enable the specific feature of LDAP acceptance queries. This involves creating an LDAP query profile that specifies the actual query string and search attributes used to validate recipient email addresses against the LDAP directory. This effectively defines 'what' query to perform.

3. Step 3: Configure the listener to use the accept query. With the LDAP server profile and the acceptance query profile defined, the incoming mail listener must be configured to utilize this query. The listener is the component that receives inbound email and needs to be explicitly instructed to apply the configured LDAP acceptance query for recipient validation before accepting email for a given address. This defines 'when' and 'for whom' the query is executed.

4. Step 4: Configure a mail flow policy. The final step is to configure a mail flow policy to take action based on the results of the LDAP acceptance query performed by the listener. For instance, a policy can be set to reject emails for recipients that are identified as invalid by the LDAP query, thereby actively preventing directory harvest attacks and enforcing the prevention mechanism.

Common mistakes.

• common_mistake. Common mistakes typically involve an incorrect understanding of the dependency chain in network security configurations. For example:
• Configuring a feature before its prerequisites are met: Placing 'Enable LDAP acceptance queries' or 'Configure the listener to use the accept query' before 'Configure an LDAP server profile' would be incorrect because the system wouldn't know which LDAP server to query or how to connect.
• Applying a check before it's defined: Attempting to configure the listener to use an accept query before the LDAP acceptance queries themselves are enabled and defined would lead to a non-functional setup.
• Enforcing policy before the mechanism is active: Configuring a mail flow policy to act on DHP results before the LDAP acceptance query mechanism is fully enabled and applied to a listener would mean the policy has no DHP status to evaluate, rendering it ineffective for this purpose. Each step is a logical prerequisite for the subsequent one.

Concept tested. The core technical concept being tested is the sequential configuration of Directory Harvest Attack Prevention (DHP) using LDAP acceptance queries on a Cisco Secure Email Gateway (ESA). This includes understanding the specific roles and dependencies of LDAP server profiles, LDAP acceptance query enablement, listener configuration, and mail flow policies in securing email infrastructure.

No community discussion yet for this question.