Refer to the exhibit. Based on the content filter which attachments will be quarantined? (Choose two.)

Question

Exhibit

Options

• Apdf attachment.
• BA .exe attachment.
• CA .pdf attachment that has had its file extension changed to .exe
• DA .msi attachment that has had its file extension changed to .pdf

• A
  72% (21)
• B
  17% (5)
• C
  10% (3)

Explanation

Options A and D are correct because the content filter operates using file extension-based detection (not true file-type inspection). Since .pdf is the quarantined extension in the filter, a genuine .pdf attachment (A) is caught, and a .msi file renamed to .pdf (D) is also caught - the filter reads the .pdf label and quarantines it regardless of the file's actual content.

B is wrong because .exe is not in the filter's quarantine list; the filter ignores it entirely. C is wrong for the opposite reason from D: a real PDF file renamed to .exe now looks like an .exe to the filter, so it slips through unquarantined - a classic bypass of extension-only filtering.

Memory tip: Think of extension-based filters as judging a book by its cover. They see the "label" (.pdf) not the contents. Slap a .pdf label on anything and it gets quarantined; peel the .pdf label off and it walks right through.

No community discussion yet for this question.