Policy, Rules and Filtering Configuration
Domain 3 tests policy routes, rules, filters, conditions, actions, and evaluation order. Expect questions on scoping rules to sender or recipient groups, content filters, DLP, encryption, hold and quarantine actions, and why one rule beats another.
Core rules
- Policy is evaluated in order; a matching terminal action can stop later rules unless the action continues.
- Scope narrows a rule by inbound or outbound direction, sender, recipient, group, or message characteristic.
- Conditions within one rule are ANDed; separate rules are ORed by evaluation.
- Actions include allow, block, quarantine, hold, modify subject, add header, redirect, encrypt, and notify.
- Test with a small group or simulation before broad rollout, and record the intended precedence.
Worked example
Rule A quarantines all messages with a macro attachment. Rule B allows [email protected] to receive macro attachments. If B is evaluated after A and A is terminal, finance mail is quarantined. Put exception B before A, or make A continue and B terminal for that group. The key is not the condition text but the order and terminal behavior.
Traps that cost marks
Assuming rule order is alphabetical; using a broad condition without scope; forgetting that a continue action allows later rules; changing a global rule for one user; and failing to test both inbound and outbound paths.