When the Spam Quarantine is configured on the Cisco ESA, what validates end-users via LDAP during login to the End-User Quarantine?

The "Spam Quarantine End-User Authentication Query" is the specific LDAP query type configured on the Cisco Email Security Appliance (ESA) to validate an end-user's credentials (username and password) during the login process to the End-User Quarantine. When external authentication for the Spam Quarantine is enabled via LDAP, this query is defined to check the submitted credentials against the LDAP directory server, granting or denying access accordingly. This is the direct mechanism for the action described in the question.

A. Enabling the End-User Safelist/Blocklist feature: This is a feature that allows authenticated users to manage their own lists; it is not the mechanism that performs the initial login authentication.
B. Spam Quarantine External Authentication Query: This is a general term. The "End-User Authentication Query" is the specific type of external authentication query used for this precise purpose, making option C more accurate.
D. Spam Quarantine Alias Consolidation Query: This query is used after successful authentication to group messages from a user's various email aliases into a single quarantine view, not for validating login credentials.

1. Cisco Secure Email and Web Manager 14.2 Configuration Guide

Chapter: Centralizing Services on a Security Management Appliance

Section: Configuring the Spam Quarantine to Authenticate End Users Against an LDAP Server.

This section explicitly states

"End-User Authentication Query: This query validates the end-user’s credentials when they log in to the Spam Quarantine." It also defines the Alias Consolidation Query separately

confirming its different purpose.

2. Cisco AsyncOS 14.0 for Email Security User Guide

Chapter: Using the Spam Quarantine

Section: Accessing the Spam Quarantine.

This guide describes the end-user login process

which relies on the authentication method configured by the administrator. The configuration of this method is detailed in the corresponding Configuration Guide

which specifies the "End-User Authentication Query" for LDAP.