Using default settings, what describes the difference between rating suspect and positive spam?

Question

Options

• ASuspect spam is scored between 50 and 74 and positive is 75 or greater.
• BSuspect spam is matched into the SUSPECTLIST, where as Positive spam matches on the BLACKLIST.
• CSuspect spam is scored between 50 and 89 and positive is 90 or greater.
• DSuspect spam has a reputation score between-1 and-3 and positive is between-3 and-10.

• A
  4% (2)
• B
  6% (3)
• C
  89% (48)
• D
  2% (1)

Explanation

Option C is correct because, in Cisco Email Security Appliance (ESA) default settings, the spam scoring engine assigns numerical scores where 50–89 indicates suspect (borderline) spam and 90 or above indicates positive (confirmed) spam - these thresholds are configurable but C reflects the out-of-box defaults.

Why the distractors are wrong:

• A is incorrect because the threshold split of 50–74 / 75+ doesn't match the actual default boundary; 75 is too low a cutoff for positive spam.
• B confuses spam scoring with list-based filtering (SUSPECTLIST/BLACKLIST) - while blocklists exist, the distinction between suspect and positive spam is score-based, not list-based.
• D describes sender reputation scores (SenderBase/Talos reputation), which use a negative scale (−1 to −10) for connection-level filtering - this is a separate mechanism from spam content scoring.

Memory tip: Think "90 to be certain" - a score of 90+ means the system is positive it's spam, while 50–89 is merely suspicious. The 90-point threshold is the key number to lock in.

No community discussion yet for this question.