Which statement about SunderBase reputation scoring on an ESA device is true?
A. Application traffic from known bad sites can be throttled or blocked
B. Sender reputation scores can be assigned to domains, IP addresses, and MAC addresses
C. Maid with scores in the medium range can be automatically routed for antimalware scanning
D. A high score indicates that a message is very likely to be spam
E. You can configure a custom score threshold for whitelisting messages
F. By default, all messages with a score below zero are dropped or throttled
I think the keyword here is “default”. The chart in the doc test2019 sent mentions (-2, -3, -4) to -10 are blacklisted (blocked), the others below 0 are “suspectlist”, which are throttled. So I believe F to also be the correct answer here.
Based on the chart shared by test2019, the default is set to the “Moderate” approach which Blocks/Throttles scores below -1 (not 0). -10 to -3 is blocked, -3 to -1 is throttled, and score -1 to 10 are accepted. So F can’t be correct. I would choose E.
Exactly
https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_0101.pdf
refer to the following link, f cannot be the correct answer because the unknown list is somewhere between -1 and 4. 0 is somewhere in between. yet it is accepted. I believe E is the answer.
on second thought, F is better answer, because on page 3 of the link there is: When sender reputation filtering is enabled, mail from known bad senders is simply refused.
should be A – table on page 4:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_0101.pdf