Which action must be taken before a custom quarantine that is being used can be deleted?

A custom quarantine is considered "in use" when it is configured as the action for one or more message or content filters. To maintain policy integrity, the system prevents the deletion of any quarantine that is actively referenced by a filter. Therefore, before the quarantine can be deleted, it must first be disassociated from all filters that use it. This is accomplished by editing the message action of each relevant filter and selecting a different action (such as another quarantine, deliver, or drop). Once the quarantine is no longer referenced by any filter, it is considered unused and can be deleted.

A: This describes the action you are trying to perform but cannot because the quarantine is still assigned to a filter. B: This applies to a quarantine that is not in use, which contradicts the scenario presented in the question. C: This also refers to deleting an unused quarantine, which is not the situation described in the question.

1. Cisco Email Security Appliance AsyncOS 14.0 User Guide

Chapter: "Centralized Policy

Virus

and Outbreak Quarantines"

Section: "Managing Quarantines".

The guide states

"You cannot delete a quarantine if it is being used by a message or content filter. You must first remove the quarantine from the message action of the filter." This directly validates that removing the quarantine from the filter's action is the required prerequisite.

2. Cisco Content Security Management Appliance AsyncOS 14.0 User Guide

Chapter: "Centralized Policy

Virus

and Outbreak Quarantines"

Section: "Managing Quarantines on the Management Appliance".

This document reiterates the same principle for centrally managed quarantines: "You cannot delete a quarantine if it is being used by a message or content filter. You must first remove the quarantine from the message action of the filter."