Which of the following descriptions of the file filtering process is correct?

Question

Options

• AIf all parameters of the file can match all file filtering rules, the module will execute the action of
• BThe file filtering module will match the application type, file type and transmission direction of the
• CThere are two types of actions to be performed: alarm and blocking.
• DIf the file type is a compressed file, then after file filtering and detection, the file will be sent to the

• A
  8% (2)
• B
  12% (3)
• C
  4% (1)
• D
  76% (19)

Explanation

Option D correctly describes a key behavior in file filtering: when a compressed file is identified, the system doesn't simply block or allow it outright - it decompresses and forwards the file for deeper inspection (typically to an antivirus or content detection engine), ensuring threats hidden inside archives are still caught.

Why the distractors are wrong:

• A is incorrect because file filtering typically uses a first-match or any-match logic - a file does not need to satisfy all filtering rules simultaneously to trigger an action.
• B is misleading or incomplete; while the module does consider application type, file type, and direction, this description alone doesn't capture the full or accurate matching behavior.
• C is wrong because file filtering actions are not limited to just "alarm" and "blocking" - most systems also support a permit/allow action, making three (or more) possible actions, not two.

Memory tip: Think of compressed files as "mystery boxes" - the filter can't just scan the wrapper, so it must open the box first (decompress) before making a security decision. If you remember that compressed files require an extra step, option D stands out as the one that reflects real-world behavior.

No community discussion yet for this question.