A network administrator enabled McAfee antivirus scanning on a Cisco ESA and configured the virus scanning action of "scan for viruses only." If the scanner finds a virus in an attachment for an…

Question

Options

• AThe attachment is dropped and replaced with a "Removed Attachment" file.
• BThe email and attachment are forwarded to the network administrator.
• CThe system will attempt to repair the attachment.
• DNo repair is attempted, and the attachment is either dropped or delivered.

• A
  7% (2)
• B
  4% (1)
• C
  4% (1)
• D
  86% (24)

Explanation

On the Cisco ESA, the 'Scan for Viruses Only' action instructs the antivirus engine to detect viruses but not attempt any repair of infected files. When a virus is detected under this mode, the ESA does not try to clean or repair the attachment. Instead, the subsequent action - drop the attachment or deliver it - is determined by the broader mail policy configuration (specifically the 'Unscannable Message Actions' or the per-policy virus actions). Option A is the behavior when the 'Drop Infected Attachments' action is explicitly configured. Option B (forward to admin) is a custom action that must be separately configured. Option C (attempt repair) corresponds to the 'Clean' or 'Repair' action setting, not 'Scan for Viruses Only.'

No community discussion yet for this question.