DRAG DROP
You have an Exchange Server 2010 Service Pack 1 (SP1) organization named contoso.com.
You are planning the anti-spam infrastructure for the organization. You need to identify which
Exchange Server 2010 SP1 anti-spam technologies achieve your anti-spam requirements. Which
technologies should you identify?
To answer, drag the appropriate anti-spam technology to the correct anti-spam requirement in the
answer area.
Answer: 
Explanation:
Content Filtering – Content filtering provides another tool to help manage the flow of messages
entering and exiting your enterprise mail stream. Content filtering enables you to filter messages
using a variety of filtering tools. These include:
Sender-domains filtering (for Realtime and Manual scan jobs), Subject line filtering (for Realtime and
Manual scan jobs).Filter set templates (simplify the creation and management of file and content
filters on all scan jobs) Sender ID – The Sender ID Framework is an e-mail authentication technology
protocol that helps address the problem of spoofing and phishing by verifying the domain name
from which e-mail messages are sent. Sender ID validates the origin of e-mail messages by verifying
the IP address of the sender against the alleged owner of the sending domain. Now adopted by
more than 10 million domains worldwide, Sender ID is providing brand owners, senders, and
receiving networks with significant business and technical value Sender Filtering – The Sender Filter
agent is an anti-spam filter that’s enabled on computers that have the Microsoft Exchange Server
2010 Edge Transport server role installed. The Sender Filter agent relies on the MAIL FROM: SMTP
header to determine what action, if any, to take on an inbound e-mail message. When you configure
anti-spam filters on an Edge Transport server, the filters act on messages cumulatively to reduce the
number of unsolicited messages that enter the enterprise. For more information about how to plan
and deploy the anti-spam features, see Understanding Anti-Spam and Antivirus Functionality. The
Sender Filter agent acts on messages from specific senders outside the organization. Administrators
of Edge Transport servers maintain a list of senders who are blocked from sending messages to the
organization. As an administrator, you can block single senders ([email protected]), whole domains
(*.contoso.com), or domains and all subdomains (*.contoso.com). You can also configure what
action the Sender Filter agent should take when a message that has a blocked sender is found.
You can configure the following actions:
The Sender Filter agent rejects the SMTP request with a “554 5.1.0 Sender Denied” SMTP session
error and closes the connection.
The Sender Filter agent accepts the message and updates the message to indicate that the message
came from a blocked sender. Because the message came from a blocked sender and it’s marked as
such, the
Content Filter agent will use this information when it calculates the spam confidence level (SCL).
Recipient Filtering – The Recipient Filter agent blocks messages according to the characteristics of the
intended recipient in the organization.
The Recipient Filter agent can help you prevent the acceptance of messages in the following
scenarios:
Nonexistent recipientsYou can prevent delivery to recipients that are not in the organization’s address book. For example,
you may want to stop delivery to frequently misused account names, such as
[email protected] or [email protected].
Restricted distribution lists
You can prevent delivery of Internet mail to distribution lists that should be used only by internal
users.
Mailboxes that should never receive messages from the Internet You can prevent delivery of
Internet mail to a specific mailbox or alias that is typically used inside the organization, such as
Helpdesk.
The Recipient Filter agent acts on recipients that are stored in one or both of the following data
sources:
Recipient Block list An administrator-defined list of recipients for which inbound messages from the
Internet should never be accepted.
Recipient Lookup Verification that the recipient is in the organization. Recipient Lookup requires
access to Active Directory directory service information that is provided by EdgeSync to Active
Directory Application Mode (ADAM).
Sender Reputation – Sender reputation weighs each of these statistics and calculates an SRL for each
sender. The SRL is a number from 0 through 9 that predicts the probability that a specific sender is a
spammer or otherwise malicious user. A value of 0 indicates that the sender isn’t likely to be a
spammer; a value of 9 indicates that the sender is likely to be a spammer.
You can configure a block threshold from 0 through 9 at which sender reputation issues a request to
the Sender Filter agent, and, therefore, blocks the sender from sending a message into the
organization. When a sender is blocked, the sender is added to the Blocked Senders list for a
configurable period. How blocked messages are handled depends on the configuration of the Sender
Filter agent.
The following actions are the options for handling blocked messages:
• Reject
• Delete and archive
• Accept and mark as a blocked sender
• If a sender is included in the IP Block list or Microsoft IP Reputation Service, sender reputation
issues an immediate request to the Sender Filter agent to block the sender. To take advantage of this
functionality, you must enable and configure the Microsoft Exchange Anti-spam Update Service.
By default, the Edge Transport server sets a rating of 0 for senders that haven’t been analyzed. After
a sender has sent 20 or more messages, sender reputation calculates an SRL that’s based on the
statistics listed earlier in this topic.