300-720 practice question 1 of 25

Which action on the Cisco ESA provides direct access to view the safelist/blocklist?

Full set: 147 questions
Answer options
A: Show the SLBL cache on the CLI.
B: Monitor Incoming/Outgoing Listener.
C: Export the SLBL to a .csv file. Correct answer
D: Debug the mail flow policy.
Correct Answer:
C. Export the SLBL to a .csv file.
Explanation

The most direct method to view the complete contents of the local safelist and blocklist on a Cisco Email Security Appliance (ESA) is by exporting the list. Within the ESA's web interface, under Mail Policies > Safelist/Blocklist, administrators can use the "Export" function. This action generates a comma-separated value (.csv) file containing all the sender entries currently in the list. This provides a complete, static, and easily reviewable copy of the SLBL database for auditing, backup, or analysis, directly fulfilling the requirement to "view" the list.

Why Incorrect

A: The slblstatus CLI command shows the operational status and cache summary (e.g., number of entries, server connectivity) of the SLBL service, not the actual list of senders. B: Monitoring listeners provides real-time data on mail connections and flow, showing the effect of the SLBL, but it does not display the configured list of senders. D: Debugging mail flow policies, such as using the trace command, shows how rules are applied to a specific message, not the entire contents of the safelist/blocklist.

References

1. Cisco Email Security Appliance Configuration Guide, 14.0: In the chapter "Managing Sender and Recipient Domains," the section on "Managing the Safelist and Blocklist (SLBL)" describes the user interface. It explicitly mentions the functionality to "Import List..." and "Export List..." from the Safelist/Blocklist page (Mail Policies > Safelist/Blocklist). Exporting is the direct action to obtain a viewable file of the list's contents.

2. Cisco AsyncOS 14.0 for Email Security CLI Reference Guide: The description for the slblstatus command states it is used to "Check the status of the Sender/IP Reputation Service." The output shown in the guide includes connection status, cache size, and update times, confirming it does not display the list entries.

3. Cisco Email Security Appliance Configuration Guide, 13.0: The chapter "Controlling Sender and Recipient Domains," section "Safelist/Blocklist Overview," details that the lists are managed on the Mail Policies > Safelist/Blocklist page, where the export function resides. This function is the primary mechanism for extracting the list for external viewing.

Scroll to Top