During which stage in a mail flow on a Cisco Email Security Appliance does content filtering occur?

Question

Options

• AReputation filtering (SBRS) > message filters > antispam > antivirus > content filter > mail policies
• BReputation filtering (SBRS) > message filters > mail policies > antispam > antivirus > content filter
• CReputation filtering (SBRS) > message filters > content filter > mail policies > antispam > antivirus
• DReputation filtering (SBRS) > mail policies > message filters > antispam > antivirus > content filter

• A
  3% (1)
• B
  3% (1)
• C
  6% (2)
• D
  89% (31)

Explanation

Option D correctly represents the Cisco ESA mail flow order: incoming messages are first screened at the connection level via SBRS reputation filtering, then matched to a mail policy, which determines which rules apply; message filters (policy-specific rules) run within that policy context; antispam and antivirus scanning follow in sequence; and finally, content filters execute as the last content inspection stage before delivery.

Why the distractors are wrong:

• A places mail policies at the very end of the pipeline - impossible, since policies must be matched early to determine which subsequent rules apply.
• B swaps mail policies and message filters (message filters before mail policies), reversing the correct policy-determination sequence.
• C moves content filtering ahead of mail policies, antispam, and antivirus - content filters depend on policy context and run after threat scanning, not before.

Memory tip: Use the phrase "Real Mail Must Avoid Viruses Constantly" - Reputation, Mail policies, Message filters, Antispam, Antivirus, Content filter. The key anchor to remember is that content filtering is always last among the scanning stages, and mail policies always come before message filters because you need to know which policy applies before executing its rules.

No community discussion yet for this question.