Refer to the exhibit. Based on the content filter condition menu, which of the following statements is correct?

Question

Exhibit

Options

• AIf the word "secret" is present in the message an action will take place.
• BIf the word "secret" is present in either the message body or attachment, an action will take place.
• CIf the word "secret" occurs a total of three times in either the message body or attachments, an action
• DIf the ABA routing number is present in either the message body or attachment, an action will take place.

• A
  3% (1)
• B
  3% (1)
• C
  81% (26)
• D
  13% (4)

Explanation

Option C is correct because the content filter exhibit shows a condition configured with both a keyword ("secret") and a minimum occurrence count of 3, applied across both the message body and attachments - meaning the action only triggers when that cumulative threshold is met, not on the first appearance.

Why the distractors are wrong:

• A is wrong on two counts: it ignores the count threshold (one instance isn't enough) and limits the scope to the message body only, omitting attachments.
• B correctly includes both body and attachments but still ignores the critical threshold - a single occurrence would not trigger the action.
• D introduces ABA routing numbers, which is a separate, distinct content filter condition (typically used for data loss prevention of financial data) - it is not what the exhibit's configuration reflects.

Memory tip: Think "3 strikes and you're out" - the filter needs to catch "secret" three times total across all content (body + attachments) before taking action. Any answer that omits either the count or the dual-scope is incomplete.

No community discussion yet for this question.