nerdexam
Cisco

700-280 · Question #23

In a "one armed installation" using a single listener, how would the system differentiate between incoming and outgoing email?

The correct answer is C. Mail flow direction is determined by using the source IP address. In a one-armed installation, a single listener handles both inbound and outbound connections, so the only reliable, automatic way to distinguish traffic direction is the source IP address of the connecting host. If the IP belongs to a trusted internal relay (e.g., your internal…

Implement and Configure Cisco Email Security Appliances

Question

In a "one armed installation" using a single listener, how would the system differentiate between incoming and outgoing email?

Options

  • AMail flow direction is determined by the "Recipient to" field in the SMTP envelope.
  • BMail flow direction is determined by the type of listener, public verses private.
  • CMail flow direction is determined by using the source IP address.
  • DMail flow direction is determined by the "Mail From" field in the SMTP envelope.

How the community answered

(36 responses)
  • A
    11% (4)
  • B
    6% (2)
  • C
    69% (25)
  • D
    14% (5)

Explanation

In a one-armed installation, a single listener handles both inbound and outbound connections, so the only reliable, automatic way to distinguish traffic direction is the source IP address of the connecting host. If the IP belongs to a trusted internal relay (e.g., your internal mail server), the system treats the message as outgoing; if it comes from an unknown/external IP, it's treated as incoming. The listener applies different policies (relay permissions, rate limits, filtering) based on which IP classification matches.

Why the distractors fail:

  • A (RCPT TO): The recipient address shows where mail is going, not whether the sender is internal or external - and it can be forged.
  • B (listener type): Public vs. private listener is the normal two-listener approach. The question explicitly states a single listener, making this distinction impossible.
  • D (MAIL FROM): The sender's envelope address is easily spoofed and doesn't reliably indicate the mail's origin network.

Memory tip: In a one-armed setup, you've lost your architectural separation (public/private listeners), so you fall back to the network layer - IP address = identity. Remember: one arm means you rely on the handshake, not the envelope.

Topics

#One-armed installation#Mail flow direction#SMTP listener configuration#Source IP detection

Community Discussion

No community discussion yet for this question.

Full 700-280 Practice