Home » Cisco » 400-251 » Which effect of this Cisco ASA policy map is true?
Refer to the exhibit. Which effect of this Cisco ASA policy map is true?
A. The Cisco ASA is unable to examine the TLS session.
B. The server ends the SMTP session with a QUIT command if the algorithm or key length is insufficiently secure.
C. it prevents a STARTTLS session from being established.
D. The Cisco ASA logs SMTP sessions in clear text.
Correct Answer: D
Explanation/Reference:
Explanation:
http://www.cisco.com/c/en/us/about/security-center/intelligence/asa-esmtp-starttls.html#interact
https://stomp.colorado.edu/blog/blog/2012/12/31/on-smtp-starttls-and-the-cisco-asa/
And in RFC 3207 that governs this TLS negotiation is said that
" If the SMTP client decides that the level of authentication or privacy is not high enough for it to continue, it SHOULD issue an SMTP QUIT command immediately after the TLS negotiation is complete.
If the SMTP server decides that the level of authentication or privacy is not high enough for it to continue, it SHOULD reply to every SMTP command from the client (other than a QUIT command) with the 554 reply code (with a possible text string such as "Command refused due to lack of security")."
Hence it is the client that sends QUIT command, not the server
This is an example of ASA logging an SMTP session that was established using TLS: Mar 07 2017 19:40:04: %ASA-6-108007: TLS started on ESMTP session between client outside:98.139.212.154/45850 and server inside:192.168.1.12/25
