300-720 Question #126: Real Exam Question with Answer & Explanation

Question

A network engineer is implementing a virus outbreak filter on a Cisco ESA by using the Outbreak Filters feature with plans to perform an additional scan by using a content filter. Which action must be taken by the Outbreak Filters?

Options

• AScan processed messages by using two engines simultaneously.
• BSend a copy of messages to quarantine.
• CSend processed messages to the Cisco ESA.
• DScan processed messages by using a secondary instance of the Cisco ESA.

Explanation

{"question_number": 10, "question": "A network engineer is implementing a virus outbreak filter on a Cisco ESA by using the Outbreak Filters feature with plans to perform an additional scan by using a content filter. Which action must be taken by the Outbreak Filters?", "correct_answer": "C", "explanation": "In the Cisco ESA processing pipeline, when Outbreak Filters are used in conjunction with content filters, the Outbreak Filters feature can be configured to scan messages and then send the processed messages back to the Cisco ESA for further processing - including content filter evaluation. This is the mechanism that enables a two-stage approach: Outbreak Filters act first using Cisco Talos threat intelligence, then the message re-enters the ESA pipeline where content filters can apply additional inspection and policy actions. Option A (two engines simultaneously) is not how ESA pipeline processing works - stages are sequential, not parallel. Option B (send a copy to quarantine) is an action Outbreak Filters can take but is not the required action to enable subsequent content filter scanning. Option D (secondary ESA instance) is not a standard ESA feature - there is no built-in mechanism to forward to a secondary ESA instance for this purpose.", "generated_by": "claude-sonnet", "llm_judge_score": 4}

No community discussion yet for this question.