Broadcom Email Security.cloud Technical Specialist (250-579) Certification Sample Questions

01. An administrator pastes an integration's API credential into a support ticket, where it becomes visible to people outside the security team.
Which action ends that credential's access to the service while leaving other integrations and administrator sign-ins working normally?
a) Reset the password on the administrator account that originally requested the credential
b) Replace the credential used by every integration the organization runs, as a precaution
c) Revoke the exposed credential and provision a replacement for the integration to use in its place
d) Remove the administrator's access to the service until the ticket has been cleaned up

02. An unsolicited message tells the recipient that a large inheritance is waiting in their name and asks for a small advance payment to release it. It carries no attachment and no link.
Why must this class of spam be caught by different means than malware-bearing spam?
a) Messages arriving without an attachment are handled entirely at the connection stage, so this one is accepted or refused before any part of its body is examined.
b) Nothing hostile is attached, so the message can only be judged on what it asks the reader to do.
c) Sender authentication decides this class, so a message that passes SPF and DKIM for its own domain is delivered without content analysis.
d) Detonation in an isolated environment supplies the verdict, so the message waits for that result.

03. The same message was sent to two employees. One reported that the link led to an ordinary product page; the other reached a page demanding payment. The address in both copies was identical.
Which explanation accounts for the difference?
a) The two employees are covered by different filtering policies, and one of the policies rewrote the address to a substitute destination
b) One copy of the message was altered in transit so that the visible address no longer matched the underlying one
c) The second employee opened the message on a device without antivirus
d) The destination can decide what to serve based on characteristics of each visitor

04. A message protected by Policy-Based Encryption must be sent to a recipient at a small external organization that has no security infrastructure in common with the sender and cannot install anything.
Which approach makes the message readable to that recipient?
a) The recipient authenticates to a service and reads the message there.
b) The recipient publishes a signing key that the sending organization uses to protect the message.
c) The sender's organization enrolls the recipient's domain in its own identity provider.
d) The recipient's mail server negotiates an encrypted session with the sending server.

05. An organization publishes an SPF record naming the sources permitted to send mail for its domain.
Which statement describes what publication achieves on its own?
a) It causes messages sent from every other source to be rejected by every receiving organization
b) It applies the organization's own inbound filtering rules to any mail that claims the domain
c) It publishes the owner's statement, and each receiver decides how to use it
d) It prevents another party from registering domains that closely resemble the organization's own name

06. A reviewer works through a queue of outbound messages held by data protection rules and must reach a decision on each one.
Which question determines the outcome for a message?
a) Whether the recipient's domain publishes a record identifying its authorized senders.
b) Whether the pattern matched the content exactly as the definition was written.
c) Whether the sender has produced a match against the same rule before.
d) Whether sending this content to this recipient is permitted.

07. Filtering goes live for a company's main domain on Monday. The administrator has written the policy but has not yet settled who reviews mail the service holds, or how a user learns that something of theirs was held.
Why does that need deciding before Monday?
a) Legitimate mail can be held from the very first message the service handles
b) Policy cannot be applied to a domain until a reviewer has been named for it
c) Mail that is held while no reviewer has been named is discarded rather than kept
d) The service will not accept mail for the domain while the review arrangement is incomplete

08. An organization has federated all administrator sign-in for Email Security.cloud with a single external identity provider.
Which operational consequence follows from that decision?
a) Every administrator gains the same permissions, as the provider becomes the single source of both identity and role
b) Inbound mail stops being filtered while the provider is unavailable, because the service checks an administrator's assertion before it applies any policy
c) Administrators cannot sign in while the provider is unavailable, since the service relies on it to authenticate them
d) Messages already held in quarantine are released automatically, given that no administrator can review them

09. An organization triggers Policy-Based Encryption on the recipient's domain: mail addressed to a named list of partner domains is protected, and everything else is not. A review finds regulated content leaving unprotected.
What is the flaw in that trigger?
a) Partner domains negotiate their own transport security, which overrides the encryption policy.
b) Sensitivity follows the content, not the destination it happens to be going to.
c) The list identifies recipients rather than senders, so no scope is applied to the rule.
d) A domain list cannot be evaluated until the receiving system has accepted the message.

10. Users report that more unwanted mail is reaching their inboxes than a month ago, and an administrator proposes classifying more aggressively.
What should the administrator expect as a direct consequence?
a) The change will apply only to sources that have no established reputation.
b) Fewer messages will reach the content stage, with a stricter setting moving the decision onto the connection stage.
c) The sources responsible will lose standing faster, which will cut the volume arriving.
d) More legitimate mail will be held, and recipients will need it back.