Exam 300-720 topic 1 question 9 discussion

When multilayer antivirus scanning is configured on a Cisco Email Security Appliance (ESA), the order of virus scanning is as follows: McAfee Engine: This engine scans the message first. If it detects a virus, the message is either dropped or repaired, depending on the configuration. Sophos Engine: If the McAfee engine determines that the message is virus-free, the Sophos engine then scans the message, adding a second layer of protection. This sequential scanning ensures that emails are thoroughly checked for viruses, enhancing the overall security of your email system.

Sophos: The ESA first uses the Sophos antivirus engine. Sophos provides both signature-based and heuristic scanning to detect known and unknown malware. McAfee: If you've also enabled the McAfee antivirus engine, the ESA will scan the email with McAfee after Sophos. Like Sophos, McAfee also employs signature-based and heuristic techniques to identify threats. The answer is 'B'

Correct.

You cannot configure the order of virus scanning. When you enable multi-layer anti-virus scanning, the McAfee engine scans for viruses first, and the Sophos engine scans for viruses second.

https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01011.html