Broadcom Messaging Gateway Technical Specialist (250-215) Certification Sample Questions

01. A message classified as spam is placed in the spam quarantine. Nobody looks at it, and the retention period configured for that quarantine elapses.
What becomes of the message?
a) It is delivered to the recipient, since the classification was never confirmed by a reviewer.
b) It is discarded, having never been delivered to the recipient.
c) It is moved into the incident folder that holds content policy matches for longer review.
d) It is returned to the sender as undeliverable so the sender learns it was not accepted.

02. An outbound message carrying an attachment was held instead of being delivered. Both content filtering policies and malware policies are in force on the gateway.
Which two observations point to the content filtering policy as the control that acted?
(Select the two correct answers.)
a) The message is waiting in an incident folder rather than in a quarantine for suspected threats
b) The attachment could not be opened for examination, so the message was held pending a later verdict
c) The attachment contains regulated customer data that a rule was written to detect
d) The connecting host's reputation was poor at the time the message was accepted for delivery

03. Outbound mail now leaves through the newly installed gateway instead of the internal mail server that previously delivered it. Within a day, several external organizations begin refusing that mail as coming from an unauthorized source.
What is the most likely cause?
a) Outbound mail is now scanned for malware, and the extra handling delays it beyond what the receiving organizations allow
b) The receiving organizations are applying a reputation decision to the gateway's address, which has no sending history with them
c) The receiving organizations require an encrypted session, and the gateway is offering delivery over an ordinary connection
d) The domain's published sender authentication record still names the previous sending host rather than the gateway

04. A report shows that one content filtering policy matched almost nothing last month, and a team proposes removing it as useless. The same month's figures show that a large volume of mail was refused earlier, at the point where connections were being accepted.
What has to be established before the policy is removed?
a) Whether the policy's action was set to notify rather than to withhold, since an action that only notifies produces no match to count
b) Whether the mail the policy was written for was refused at the connection, before it ever reached the stage the policy acts at
c) Whether the report was produced for the whole month rather than for a shorter period inside it, since a narrower period counts less
d) Whether that content filtering policy was itself responsible for the refusals, since a policy of that kind can also act while a connection is open

05. Mail from a business partner reaches your users after passing through an industry mailing list, which appends a short standard footer to each message before sending it on. The partner signs its outbound mail with DKIM, and your gateway records that the signature no longer validates on messages arriving by that route.
What accounts for this result?
a) DKIM signs the message content, so a change made to that content in transit, such as an appended footer, invalidates the signature
b) DKIM depends on the connecting address matching the signing domain, which a mailing list's own server does not
c) DKIM results expire in transit, so a message held on an intermediate server arrives with no usable signature
d) DKIM validates only for messages delivered directly, and any additional relay hop breaks the signature

06. A gateway accepts every message addressed to the organization's domain and lets the internal mail server generate a non-delivery notice for addresses that do not exist. Most of those notices are returned to forged sender addresses.
Which consequence does rejecting invalid recipients during the SMTP conversation avoid?
a) Malware verdicts are reached only after the message has been queued.
b) Sender authentication checks are deferred until after the message body has been accepted in full.
c) Connections from unknown networks are accepted without any reputation evaluation.
d) The organization becomes a source of backscatter aimed at people who never wrote to it.

07. While chasing an intermittent fault, an administrator raises the level of detail recorded. Two days later the fault is still unexplained, and colleagues say that finding anything in the records has become slow and unrewarding.
What is the better course?
a) Move the investigation to the summary report for the period, since that view is unaffected by how much detail is being recorded.
b) Lower the level again and reproduce the fault inside a short, planned window.
c) Leave the level raised indefinitely, since a fault that appears rarely can only be caught by recording everything continuously.
d) Raise the level further, so that entries carry enough detail to be filtered down to a small result set.

08. After a new gateway is placed in the outbound mail path, the internal mail servers receive a relaying-denied response when they try to send mail through it.
What is the most likely cause?
a) The internal servers are not authorized to relay outbound mail through the gateway
b) The gateway is treating the internal servers as an unknown source and quarantining their messages
c) Sender authentication is failing because the internal servers do not sign their outbound mail
d) The gateway's malware policy is set to reject mail that originates inside the organization

09. One connecting host is delivering to a long series of recipient addresses in your domain, most of which do not exist. An ordinary correspondent that happens to hold one outdated address also produces failed recipient attempts.
What distinguishes the harvesting attempt from the ordinary correspondent?
a) Each message from the source names one recipient at a time rather than listing many recipients on a single envelope
b) The message bodies arriving from the source are identical to one another, which ordinary correspondence never is
c) A single source attempts many addresses that are absent from the directory, far more than it resolves
d) The source has published no sender authentication record, so its recipient attempts cannot be trusted

10. A newly installed Scanner has completed initial setup, but public mail records still point at the previous gateway. The team wants to confirm the deployment behaves correctly before cutover.
Which two checks address the risk of misuse or of breaking legitimate mail flow?
(Select the two correct answers.)
a) Confirm the Control Center can accept SMTP sessions for the Scanner while the records still point elsewhere.
b) Confirm that mail from internal senders still reaches external recipients as intended.
c) Confirm that reputation-based connection decisions are not applied until after the cutover has finished.
d) Confirm that the Scanner refuses mail addressed to domains the organization does not host, so it cannot be used as an open relay.