By default, how do Outbreak filters avoid quarantining false positives?

Question

Options

• AFalse positives do not occur as the Anti-Virus engine will check the signature against the incoming mail.
• BFalse positives are released as updates provide a better description of suspected attachment.
• CPositive matches are not quarantined. They are dropped.
• DAll false positives must be quarantined until a Virus signature is received so that they can be checked.

• A
  2% (1)
• B
  91% (40)
• C
  5% (2)
• D
  2% (1)

Explanation

Option B is correct because Outbreak filters work by temporarily quarantining suspicious messages, not permanently blocking them. As Cisco Talos publishes updated threat intelligence with more refined descriptions of the suspected attachment or URL, the filter re-evaluates quarantined messages and automatically releases anything that no longer matches the updated threat profile - turning former false positives into delivered mail.

Why the distractors fail:

• A is wrong because Anti-Virus engines rely on known signatures and cannot prevent Outbreak filter false positives - Outbreak filters are specifically designed for zero-day threats before signatures exist.
• C is wrong because Outbreak filters quarantine matches, not drop them; dropping would cause permanent, unrecoverable mail loss.
• D is wrong because false positives are released by updated outbreak rules/descriptions, not by waiting for a full virus signature - those are two different mechanisms.

Memory tip: Think of Outbreak filters as a "cooling-off quarantine" - mail is held on suspicion, and as smarter intel arrives, innocent mail is released. The filter learns and corrects itself automatically.

No community discussion yet for this question.