In the access log, what does an ACL tag beginning with BLOCK_ADMIN indicate?

Question

Options

• AThe transaction was blocked because of application or object properties.
• BThe malware category is set to blocking mode.
• CThe transaction was manually blocked by the administrative user.
• DThe destination was manually added to the block list.

• A
  87% (39)
• B
  2% (1)
• C
  7% (3)
• D
  4% (2)

Explanation

BLOCK_ADMIN is an ACL (Access Control List) tag used in proxy/security appliance access logs to indicate that a transaction was blocked due to application or object properties - such as file type, application category, or object characteristics configured in policy rules. This is an admin-defined policy block based on what the traffic is, not a manual one-time action.

Why the distractors are wrong:

• B is wrong because malware blocking uses a different tag category (typically something like BLOCK_SUSPECT or threat-related tags, not BLOCK_ADMIN).
• C is wrong because "manually blocked by the admin user" implies a real-time, one-off intervention - that's not what this tag represents; the block is policy-driven, not interactive.
• D is wrong because manually adding a destination to a block list produces a different tag (often BLOCK_CUSTOMCAT or a destination-specific tag), since that's URL/IP-based blocking, not object/application-based.

Memory tip: Think of ADMIN as short for "administrative policy" - the admin configured rules about what types of applications or objects are blocked. If the admin manually intervened in real time or added a site to a list, the tag would reflect that specific mechanism instead.

No community discussion yet for this question.