300-720 Question #148: Real Exam Question with Answer & Explanation

Question

The CEO added a sender to a safelist but does not receive an important message expected from the trusted sender. An engineer evaluates message tracking on a Cisco ESA and determines that the message was dropped by the antivirus engine. What is the reason for this behavior?

Options

• AEnd-user safelists apply to antispam engines only.
• BThe sender didn't mark the message as urgent.
• CAdministrative access is required to create a safelist.
• DThe sender is included in an ISP blocklist.

Explanation

{"question_number": 10, "correct_answer": "A", "explanation": "On Cisco ESA, the safelist/blocklist (SLBL) feature - including end-user safelists - only bypasses antispam scanning. It does not exempt messages from antivirus scanning, outbreak filter scanning, or content filter policies. This is a deliberate security design: safelists are intended to prevent legitimate mail from being flagged as spam, but a trusted sender could still unknowingly send a virus-infected attachment or a message triggering malware detection. Since the antivirus engine operates independently of the SLBL and has no exemption for safelisted senders, it dropped the message upon detecting a threat. Choice B is irrelevant - message priority flags don't affect antivirus behavior. Choice C is incorrect because end users can create their own safelists (that's the purpose of end-user access). Choice D would have caused the message to be blocked at the connection or reputation layer, not by the antivirus engine.", "generated_by": "claude-sonnet", "llm_judge_score": 4}

No community discussion yet for this question.