Exam 350-701 topic 1 question 419 discussion

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118775-technote-esa-00.html

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118775-technote-esa-00.html untrusted -10 to -6 questionable -5.9 to -3.1 neutral -3 to 0 favorable .1 to 5.9 trusted 6 to 10

<p>This is an HTML part of the message</p> <p>Link1: http://malware.testing.google.test/testing/malware/ and some text</p> <p>Link2: CLICK ME some text</p> <p>Link3: http://malware.testing.google.test/testing/malware/ and some text</p> <p>Link4: http://cisco.com and some text</p> the result of the defang action taken on the text/html part of the MIME message is a stripped A-tag and the tag content is left untouched. In the two first paragraphs, both links were defanged where the HTML code was stripped and the text part of the element was left. The URL address in the first paragraph is the one from the text part of the HTML element. It must be noted the URL address from the first paragraph is still visible after the defang action was taken but without the HTML A-tags, the element must not be clickable. The third paragraph is not defanged as the URL address here is not placed between any A-tags, and is not considered as a link.

*desirable is a typo: disable

A Defang because "Which action will the system perform to desirable any links in messages that match the filter?", on Quarantine the whole email is quarantined, not only the link.

Defang. I saw in another place that question mentions -10 and -6 and then talks about disable the URL.

Its C 10 to 6 its quarantine -10 to -6 its Defang

It is A, Defang. https://www.cisco.com/c/en/us/support/docs/security/secure-email-gateway/218170-understand-the-url-defang-and-redirect-a.html

It's definitely C. As per the cisco link, scroll down to 'Untrusted URL(s)': https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118775-technote-esa-00.html "With this content filter in place, Cisco Secure Email scans for a URL with an Untrusted reputation (-10.00 to -6.00) and places the message into a quarantine, URL_UNTRUSTED." I'm going with C, Quarantine.

A: An Incoming Content Filter with a URL reputation score range of "10.00 to "6.00 on the Cisco ESA is configured to block or defang links in messages that have a low reputation score. Defanging means that the URL is rewritten so that it is not clickable or does not point to the original destination. This helps to prevent users from inadvertently clicking on malicious links in emails, thereby reducing the risk of phishing attacks and other forms of email-borne threats.

Answer is D Name: URL_Malicious Add One Condition: URL Reputation: URL Reputation is: Malicious (-10.0 to -6.0) Add One Action: Quarantine: Send message to quarantine: “URL Malicious Inbound (centralized)” Duplicate message: Disabled (**** Quarantine the original ****)