An agency record shows the sender, the recipient, the attachment name, and a phishing verdict. Which source produced that record?
Select an answer to reveal the explanation.
Short Explanation
The mailroom mark shows you who sent the letter, who should receive it, and whether the attachment looked hostile. That agency record is email content filtering. A web category, an allowed connection, or a switch address table does not open the message.
Full Explanation
Email content filtering inspects a message. The useful fields are who sent it, who was supposed to receive it, what the attachment was called, and what the filter decided about phishing. The agency record is exactly those fields. Email content filtering that records the sender, recipient, attachment name, and the phishing verdict. Web policy uses a different object. Web content filtering that records a URL category and an allow decision for one browser request classifies a URL for a browser, and it does not carry a mail sender, a recipient, or an attachment verdict. A connection log is thinner than a message. A stateful firewall record of an allowed connection with no mail headers and no phishing verdict can show that a session was permitted and still contain none of the four mail facts. Layer 2 forwarding is further away. A switch MAC address table that maps one hardware address to a single access-switch port tells you where a frame entered the switch and nothing about a message or a phish verdict. Exam caveat: web filtering and email filtering both judge content, and the exam splits them by the fields. Sender, recipient, attachment, and a phish verdict belong to email filtering. Operational check: match those four fields to the mail gateway log and confirm the web-filter log has no row with that attachment name.