Cisco ESA TCP Reset for Malicious Domain Prevention
Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities
Answer
Correct answer: A — Configure the Cisco ESA to reset the TCP connection.
An organization is receiving SPAM emails from a known malicious domain. What must be configured in order to prevent the session during the initial TCP communication?
Community Insight
The exam focuses on the OSI layer distinction: preventing 'initial TCP communication' requires a Layer 4 action (TCP Reset), whereas rejecting messages is a Layer 7 SMTP action that allows the TCP handshake to complete first.
This question tests the specific mechanism in Cisco Email Security Appliance (ESA) required to interrupt a connection at Layer 4. The correct configuration utilizes TCP reset actions to prevent session establishment during initial communication.
Many candidates select 'Reject' because it stops the email content, but this occurs after the TCP session is established and the SMTP dialogue begins, failing the 'initial TCP' constraint.
Community Discussion (29 comments)
XBfoundX
👍 1
Selected: A
REJECT. Connection is initially accepted, but the client attempting to connect gets a 4XX or 5XX SMTP status code. No email is accepted. TCPREFUSE. Connection is refused at the TCP level. This question is anyway confusing, but the issue is that if we use the action REJECT we are saying that at least the TCP Session will be accepted, we will block then the SMTP session if the REJECT action.
TanHK
👍 1
Selected: B
Why the Others Are Incorrect A. Reset the TCP connection ❌ Used for IP-based blocking, not domain-based identity C. Drop malicious emails ❌ Happens after the email is received D. Quarantine malicious emails ❌ Also post-acceptance
A_Wolf
👍 2
Selected: B
I'd go for B. the question is PREVENT, a reset, resets the connecton (connection already took place) read this: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html You can configure your Email Security Appliance (ESA) to restrict connections by adding any of these items to Sender Groups which use Mail Flow Policies: IP range Specific host or domain name SenderBase Reputation Service (SBRS) "organization" classification SBRS score range DNS List query response Each Mail Flow Policy has an access rule, such as ACCEPT, REJECT, RELAY, CONTINUE, and TCPREFUSE. A host that attempts to establish a connection to your ESA and matches a Sender Group using a TCPREFUSE access rule is not allowed to connect to your ESA. From the standpoint of the sending server, it will appear as if your server is unavailable. Most MTAs will retry frequently in this case, which will create more traffic then answering once with a clear hard bounce, for example, REJECT.
Demon_Queen_Velverosa
👍 1
The answer is B. The hint is TCP and not referring to anything high than TCP. A would only be valid if the TCP connection had already been established and if the ESA has that reset ability. in this case reset wouldn't even do anything as their is no connection to reset as a connection is trying to be established. C and D don't have anything to do with the question.
Premium_Pils
👍 2
Selected: A
Answer "B", REJECT would be the preferable solution based on this article: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html. However, answering with "554 SMTP error" seems to correspond with Layer 7, and not with Layer 4 (TCP). A TCP Reset acts at Layer 4. Thus, for me it is "A".
4pelos
👍 1
Correct answer B. Checked with securitytut
cristip
👍 1
Selected: B
I think it is B
fdl543
👍 2
Selected: A
A is correct. "prevent the session during the initial TCP communication" Only reset the TCP connection does this. B continues to communicate with the reject communication...
jku2cya
👍 1
Selected: B
Typical ambiguous Cisco exam question. However I'd say A corresponds to TCPREFUSE and B corresponds to REJECT. B also mentions the word 'reject' in it. Also the link provided by multiple people in this thread states "A host that attempts to establish a connection to your ESA and encounters a REJECT will receive a 554 SMTP error (hard bounce)"
DWizard
👍 1
Selected: B
Based on the links already shared, the best answer would be B. C and D does not work at the TCP level, and option A does not really reset the TCP connection, just ignore it, so the sender will try again to send the email. Option B will work in a similar way to A, but instead of ignoring the TCP connection, will reject it so the sender won't try again. It's a difficult one, I don't hope that everybody agrees with me.
PeterHasse
👍 1
I think is A https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118214-configure-esa-00.html
Jessie45785
👍 1
Selected: B
B - its cisco question must be B https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html
theunnameddemon
👍 1
To prevent the session during the initial TCP communication with a known malicious domain and stop receiving spam emails, the appropriate action would be: A. Configure the Cisco ESA to reset the TCP connection. By configuring the Cisco ESA (Email Security Appliance) to reset the TCP connection, it would terminate the connection attempt during the initial handshake process. This prevents any further communication between the sender and the recipient, effectively blocking the spam emails from that malicious domain. Options B, C, and D are not specifically related to preventing the TCP session during initial communication: Option B: Configuring policies to stop and reject communication might be effective in blocking or filtering certain types of traffic or communication, but it doesn't specifically prevent the TCP session from being established.
west33637
👍 8
Selected: A
A should be correct - TCPREFUSE resets the TCP connection. The question asks for preventing the session during the initial TCP communication. The remaining answers do not specify dropping the communication at TCP level.
sis_net_sec
👍 1
Selected: D
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118219-configure- esa-00.html
NikoNiko
👍 2
"You can configure your Email Security Appliance (ESA) to restrict connections by adding any of these items to Sender Groups which use Mail Flow Policies: IP range Specific host or domain name SenderBase Reputation Service (SBRS) "organization" classification SBRS score range DNS List query response Each Mail Flow Policy has an access rule, such as ACCEPT, REJECT, RELAY, CONTINUE, and TCPREFUSE. A host that attempts to establish a connection to your ESA and matches a Sender Group using a TCPREFUSE access rule is not allowed to connect to your ESA." Source (2014): https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html Newer (2021) - the same but TCPREFUSE is replaced by "TCP refuse": https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/216842-understand-parameters-related-to-mail-fl.html
lucky2205
👍 2
Selected: B
its B Each Mail Flow Policy has an access rule, such as ACCEPT, REJECT, RELAY, CONTINUE, and TCPREFUSE. A host that attempts to establish a connection to your ESA and matches a Sender Group using a TCPREFUSE access rule is not allowed to connect to your ESA. From the standpoint of the sending server, it will appear as if your server is unavailable. Most MTAs will retry frequently in this case, which will create more traffic then answering once with a clear hard bounce, for example, REJECT. https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html
Dorr20
👍 2
A "reject" will send an NDR so it's not preventing the session. You also don't want a "known malicious" domain to know you are accepting message from other domains as you are trying to hide your ESA from attackers.
Minion2021
👍 3
Answer is B.
efongvan
👍 1
I would choose answer A. The question says prevent the session during the "initial TCP" communication. The explanation from the link below for TCPREFUSE and REJECT. TCPREFUSE: Connection is refused at the TCP level. REJECT: Connection is initially accepted, but the client attempting to connect gets a 4XX or 5XX SMTP status code. No email is accepted. https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118179-configure-esa-00.html
lurker8000
👍 3
I think the answer is B based on this doc: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118219-configure-esa-00.html
jaciro11
👍 4
The answer is B. If you use ESA you know there is no option like TCP reset. You can Reject the message from know malicious sites.
eazy99
👍 2
I believe the correct answer is B, it took me a while to decide. But I decided to go with B after doing some researching. Even though we have quarantine malicious as an option, and this is kind of the basic. If you want to go advanced and according to Cisco it’s a better method, u should go with the TCPREFUSE and Reject. Which will drop the email like your server is not even available. Here is a link to support what I just shared https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html
kerniger
👍 7
hm it seems there is no clear valid answer A - probably the best answer because if you configure as "TCPREFUSE" it will send a "reset" at tcp. B - the client gehts responses at a higher level than tcp C - its not at tcp layer D - its not at tcp layer https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118179-configure-esa-00.html
klu16
👍 2
Based on this, I would go with B... https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00. html
nospampls
👍 2
correct = D The recommended best practice is to configure Quarantine action on Positively-Identified Spam setting with the prepended text [SPAM] added to the subject and https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/215164-best-practice-guide-for-anti-spam-anti.html#anc7 and there is no stop and reset action in the drop-down menu
jaciro11
👍 3
Man you don´t read the question, they told about make a reset in the connection not quarantine the message
hisho72
👍 2
Answer: B Explanation: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118214-configure-esa-00.h tml
statikd
👍 2
The answer should be B. "What must be configured in order to prevent the session during the initial TCP communication?" So how does configuring a policy to quarantine malicious email prevent the TCP communication? It does not, it will just keep quarantining the malicious SPAM emails every time they show up...
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is correct because configuring the Cisco ESA to "reset the TCP connection" acts at Layer 4 of the OSI model. When a connection from a known malicious domain is detected, a TCP RST packet terminates the transport layer session immediately. This ensures that no application-layer data (SMTP commands) is exchanged, satisfying the requirement to prevent the session during the initial TCP communication.Why the Other Options Are Wrong
Options B, C, and D operate at Layer 7 (Application Layer). "Rejecting" communication involves sending an SMTP error code (e.g., 554) back to the client, which requires the TCP handshake to be fully completed and the SMTP conversation to begin. Similarly, dropping or quarantining emails happens after the message has been received via the established TCP session. Therefore, they do not prevent the TCP session itself from forming.Community Comment Notes
Community consensus was split between A and B. As user west33637 noted, "A should be correct - TCPREFUSE resets the TCP connection," emphasizing the layer difference. User kerniger reinforced this by stating, "if you configure as 'TCPREFUSE' it will send a 'reset' at tcp," contrasting it with higher-level responses. While some users argued for B based on general mail flow policies, the technical specificity of "initial TCP communication" makes the TCP reset the only precise answer.Official Reference
Exam Strategy
When questions specify "Layer 4", "TCP", or "Connection", look for actions like "Reset", "Drop at Firewall", or "Block Port". When questions specify "Email Content", "SMTP Error", or "Message Delivery", look for "Reject", "Quarantine", or "Delete".
Frequently Asked Questions
What is the difference between TCP Reset and SMTP Reject?
TCP Reset (RST) terminates the Layer 4 transport session immediately, preventing any SMTP data exchange. SMTP Reject sends a Layer 7 error code after the TCP handshake completes.
Why can't I just drop the email instead of resetting TCP?
Dropping the email implies the ESA received it, which requires a successful TCP session. To prevent the session itself, you must act at the transport layer with a reset.