When multilayer antivirus protection is configured on the Cisco Email Security Appliance (ESA), a specific, non-configurable scanning order is used. The appliance first scans messages and attachments using the McAfee antivirus engine. If the message is not convicted by McAfee, it is then passed to the Sophos antivirus engine for a second scan. This fixed order ensures a consistent and predictable security posture. The term "default engine" is not used in this context; the specific engines are McAfee and Sophos.

A: The scanning order is incorrect, and "default engine" is an imprecise term for the Sophos engine in this context.

B: This states the reverse of the correct scanning order. Sophos scans second, not first.

C: While the first engine is correct, "default engine" is an imprecise term. The second engine is specifically the Sophos engine.

1. Cisco. (2021). AsyncOS 14.0 for Cisco Email Security Appliances - User Guide. Chapter: Protecting Against Viruses and Malware

Section: About Antivirus Scanning. "If you enable both the McAfee and Sophos antivirus engines

the appliance scans messages with the McAfee engine first

and then with the Sophos engine."

2. Cisco. (2020). AsyncOS 13.5 for Cisco Email Security Appliances - User Guide. Chapter: Protecting Against Viruses and Malware

Section: How the Appliance Scans for Viruses. "When you enable both McAfee and Sophos antivirus scanning

the appliance scans messages with the McAfee engine first

and then with the Sophos engine."