Which of the following are true regarding Spam Detection? Pick the 3 correct responses below.

In the Proofpoint Protection Server (PPS), Policy Routes are the fundamental mechanism used to direct email traffic to the appropriate policy. A message is evaluated against the list of policy routes, and the first route it matches determines which single policy is applied. It is a standard security best practice to create separate, distinct policies for inbound and outbound mail flows, as their security requirements differ significantly. For any given message, the spam detection engine will analyze it against numerous signatures and characteristics, but it will ultimately assign a single, final disposition (e.g., Spam, Phishing, Bulk), meaning only one determinative rule "fires" to classify the message for a specific recipient.

A. The lowpriority and bulk rules can be used concurrently; enabling one does not require disabling the other. Administrators can tune the scores and actions for each rule independently.

C. The PPS processing model applies only one policy to a message. Processing stops once the message matches its first applicable policy route, preventing multiple policies from being applied.

F. Spam Detection identifies unsolicited and malicious email. Preventing the outbound transmission of confidential information is the function of a Data Loss Prevention (DLP) module, not the spam engine.

1. Proofpoint Protection Server 8.18 Administration Guide

Chapter 4: Policies

"About Policies and Policy Routes

" Page 69. "When the Protection Server receives an email message

it checks the policy routes to determine which policy to apply to the message... The Protection Server evaluates policy routes in the order they appear on the Policy Routes page. The first route that the message matches is the one that is applied." (Supports B; Refutes C).

2. Proofpoint Protection Server 8.18 Administration Guide

Chapter 2: Getting Started

"Initial Configuration Best Practices

" Page 45. "Create separate policies for inbound and outbound mail. You will want to apply different rules to inbound and outbound mail." (Supports E).

3. Proofpoint Protection Server 8.18 Administration Guide

Chapter 5: Spam Detection

"Spam Detection Rules

" Page 96. The guide describes the different spam rules (e.g.

Spam

Phishing

Adult

Bulk) as distinct classifications. The system applies a single verdict based on the evaluation

which then triggers a specific action based on that one classification. (Supports D).

4. Proofpoint Protection Server 8.18 Administration Guide

Chapter 7: Data Loss Prevention

"About Data Loss Prevention

" Page 163. This chapter explicitly defines the purpose of DLP as preventing confidential data from leaving the organization

distinguishing its function from Spam Detection. (Refutes F).