A security administrator notices that a significant volume of spam is bypassing the Cisco ESA's anti-spam filters. Upon investigation, they find that the messages have a mid-range SBRS score of 5.0. Which action should the administrator take to improve spam detection?
Trap 1: Change the SBRS score interpretation to positive
Changing the SBRS interpretation to positive would not adjust the threshold and could cause confusion or misclassification.
Trap 2: Lower the SBRS threshold to 3.0
Lowering the threshold to 3.0 would actually reduce spam detection because the threshold is the score below which messages are considered spam. A lower threshold means fewer messages qualify as spam, so the 5.0 messages would still be considered legitimate.
Trap 3: Disable SenderBase reputation checks
Disabling SenderBase reputation checks removes reputation-based filtering, which would likely increase the amount of spam reaching users.
- A
Change the SBRS score interpretation to positive
Why wrong: Changing the SBRS interpretation to positive would not adjust the threshold and could cause confusion or misclassification.
- B
Lower the SBRS threshold to 3.0
Why wrong: Lowering the threshold to 3.0 would actually reduce spam detection because the threshold is the score below which messages are considered spam. A lower threshold means fewer messages qualify as spam, so the 5.0 messages would still be considered legitimate.
- C
Increase the SBRS threshold to 7.0
Raising the threshold to 7.0 means any message with an SBRS below 7.0 is classified as spam. Since the problematic messages have a score of 5.0, they would now be caught, improving spam detection.
- D
Disable SenderBase reputation checks
Why wrong: Disabling SenderBase reputation checks removes reputation-based filtering, which would likely increase the amount of spam reaching users.