Adding Email Headers and Transit Protection

Why B is correct Cisco Secure Email Gateway provides message encryption through an encryption profile associated with the Cisco Secure Email Encryption Service / Cisco Registered Envelope Service (CRES). Cisco’s current configuration process requires the administrator to: Enable email encryption. Create an encryption profile. Configure the hosted key service and encryption/security settings. Provision the email gateway/profile with the hosted encryption service. Create and enable an outgoing content filter or DLP policy to select the messages that must be encrypted. cisco.com Cisco specifically states that provisioning the email gateway registers the encryption profile with the hosted key service. Once provisioning is complete, the ESA can encrypt mail through CRES. cisco.com +1 So, if the engineer needs to add email encryption protection, the configuration dependency represented in the choices is: B. Provision the email appliance. Where the headers fit The header portion does not change the answer to D. In the current Cisco Secure Email Gateway workflow, AsyncOS can add encryption settings to a message by inserting SMTP headers through a content filter or message filter. Cisco documents this as an Add Header or Add/Edit Header action. Example headers can control encryption-envelope options such as: Secure reply Secure Reply All Secure forwarding Read receipts Registered-envelope expiration JavaScript-free envelopes Decryption-applet behavior cisco.com These headers are optional, per-message overrides of settings otherwise held in the encryption profile. Before the ESA can encrypt and process those messages through Cisco’s hosted encryption service, however, the gateway/profile must be provisioned. cisco.com +1

the keyword here is add protection of the data in transit, for doing so there were dedicated hardware appliances called, Cisco ironport encryption appliance, now the service is used via cloud using: Secure Email Encryption Service https://www.cisco.com/site/us/en/products/security/secure-email/secure-email-encryption-service/index.html

Cisco AsyncOS handles this by utilizing either an on-premise physical/virtual encryption appliance

According to Cisco's official Email Encryption documentation: "The Cisco IronPort Encryption appliance must be set up to handle flagged messages" and to insert encryption headers into messages — confirming the encryption appliance is the correct solution for both data in transit protection AND email headers

The key requirements are: Protection for data in transit (encryption) Ability to add/modify headers in email messages The best answer is: B. Provision the email appliance. Why: An email appliance (such as a secure email gateway) is specifically designed to: Encrypt emails in transit Inspect, modify, and add email headers Enforce email security policies (DLP, TLS, etc.)

Terrible question by Cisco, but let's get to facts: Encryption Appliances are out of support for almost a decade (were made EoS in 2015). Deploying the Email Appliance allows you to add protection for data in transit as you can encrypt the conversation with TLS and/or even encrypt the data itself with S/MIME. Also, using Content Filtering and other features you are able to add/edit Headers. Therefore I would go with B.

I Think it is A

I'd say B more than A, but who knows. Again another ambiguous exam question, to prove one knows Cisco Security knowledge..

Just looked at this again. I'd stick with B. Question says "Which configuration is needed". The verb 'deploy' corresponds to adding in something new, like a new device. The verb 'configure' corresponds to changing something that already exists.

After doing more research I will change my answer to A. To add protection for data in transit and have headers in the email message, an engineer needs to deploy an encryption appliance. This is discussed on page 1 of the Cisco Email Encryption PDF guide under the section "How to Encrypt Messages with a Local Key Server" and on page 11 under "Inserting Encryption Headers into Messages". Therefore, the correct answer is A. Deploy an encryption appliance. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_010010.pdf

It's B. To add protection for data in transit and have headers in the email message, you need to insert encryption headers into messages using either a content filter or a message filter. The encryption header can override the encryption settings defined in the associated encryption profile, and it can apply specified encryption features to messages. Therefore, option B (provision the email appliance) is needed to accomplish this goal. Option A (deploy an encryption appliance) may also be necessary depending on your organization's needs. Options C (map sender IP addresses to a host interface) and D (enable flagged message handling) are not directly related to this goal.

option D

option C

Correct B

option A

B. Provision the email appliance Provisioning the email appliance, also known as an Email Security Gateway or Email Security Appliance, is a solution for protecting data in transit and adding headers to email messages. The email appliance acts as a security layer between the email servers and the Internet, and provides a range of security features such as encryption, anti-virus, anti-spam, and content filtering. These features help to ensure that emails are transmitted securely, and help to prevent unauthorized access to sensitive information. By provisioning the email appliance, the engineer can add protection for data in transit and have headers in the email message.

A. Deploy an encryption appliance. Deploying an encryption appliance is the configuration that is needed to add protection for data in transit and have headers in the email message. An encryption appliance encrypts data before it is transmitted over a network, providing protection against eavesdropping and unauthorized access to sensitive information. By deploying an encryption appliance, the engineer can add protection for data in transit and ensure that headers are added to the email message. This solution provides a secure way to transmit data and helps to prevent unauthorized access to sensitive information.

The encryption header can override the encryption settings defined in the associated encryption profile, and it can apply specified encryption features to messages.

I prefer A

AsyncOS supports using encryption to secure inbound and outbound email. To use this feature, you create an encryption profile that specifies characteristics of the encrypted message and connectivity information for the key server. The key server may either be: The Cisco Registered Envelope Service (managed service ), or An Cisco Encryption appliance (locally managed server) 😜it should b (A) as to locally manage one must first deploy it.

A is correct. WSA: " AsyncOS enables you to add encryption settings to a message by inserting an SMTP HEADER into a message using either a content filter or a message filter. The encryption header can override the encryption settings defined in the associated encryption profile, and it can apply specified encryption features to messages. NOTE: The Cisco Ironport ENCRYPTION APPLIANCE must be set up to handle flagged messages." As question states that headers are already in the email messages, we need only Encryption Appliance to do its work. https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_010010.html#task_1146822

The Cisco IronPort Encryption Appliance is now obsolete (past End-of-Life and End-of-Support status). End-of-Sale Date: 2012-07-19 End-of-Support Date: 2015-07-31 => Either this question is outdated since almost 10 years or this functionality is somehow merged in the ESA itself.