Content filter with PDF attachment to quarantine

[zheka_pefti]

Hello Ironport email security gurus and those who are partial to this product.

Working in a company that is Cisco partner I was recently asked to pass 650-153 exam - Cisco Email Security Field Engineer Specialist

Thinking that I still have a sufficient amount of knowledge and skills I leafed through my notes and tried the exam. To my suprise I failed it. There were questions that I absolutely had no idea how to answer. One of them is attached.

Can someone please advise what's the second correct answer? Why do they put two options with executable attachment types? Is it not straitforward that if we define the content filter listing a particular attachment type to be quarantined then the filter should filter this attachment type?

[Ken Stieers]

Based on what I can see, the second answer is the MSI with the name changed... (its testing for attachment-filename, NOT attachment-filetype, where it checks to see what the TYPE of the file is, regardless of name)

They put that in to test you undertanding of attachment-filename vs attachement-filetype... If you don't KNOW about filetype, you'll leave a hole you can drive a truck through...

(really, some people assume that if the file ends in a .pdf, it must be a pdf.... )

[zheka_pefti]

Hello Ken,

That was my point. As far as I understand it if the attachment file type is PDF than the MIME type check will determine that it is PDF no matter what extension of the file is.

Now my question is as follows. If we enable the content filter with the condition "Attachment File Info" there are four condtions that can be matched on:

1) File name

2) File type

3) MIME type

4) Image verdict

Is it OR or AND condition ?

[Ken Stieers]

It only checks mime type, if your rule is "attachment-type"    The test question was for attachment-filename...

As to the AND/OR question see below...

When you add more than one condition the GUI lets you pick if it is ANDing them all, or ORing them all...