How to Manually Update Outbreak Filter Rules on Cisco Secure Email Gateway?
An engineer is deploying a Cisco Secure Email Gateway and must ensure it reaches the Cisco update servers to retrieve new rules. The engineer must now manually configure the Outbreak Filter rules on an AsyncOS for Cisco Secure Email Gateway. Only outdated rules must be replaced. Up-to-date rules must be retained. Which action must the engineer take next to complete the configuration?
Community Votes
83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the GUI action that fetches Outbreak Filter rule updates versus CLI/Database options, with the trap being outbreakconfig, which only displays or edits filters already on the appliance.
On an AsyncOS-based Cisco Secure Email Gateway, manually refreshing Outbreak Filter rules is done from Security Services > Outbreak Filters by clicking Update Rules Now, which pulls only stale rules from Cisco's update servers while current rules stay in place. This page confirms why that action, not the outbreakconfig CLI command, completes the configuration.
Picking outbreakconfig (A) because it is the only Outbreak Filter-specific CLI command; it configures and displays existing filter settings but never downloads new rules from Cisco's update servers.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Clicking Update Rules Now on the Security Services > Outbreak Filters page is the manual action that tells AsyncOS to contact Cisco's update servers and retrieve the newest Outbreak Filter rule set. The update is incremental by design: the appliance compares its local rule version against the server's and downloads only the rules that changed, which is exactly the stated requirement that "only outdated rules must be replaced" and up-to-date rules be retained. Because the task is a manual refresh of rules rather than a change to filter settings, this button is the step that actually completes the configuration. Cisco's ESA 15.0 admin guide documents this same page and control for manual rule updates, and the strong community vote for D reflects that documentation.Why the Other Options Are Wrong
A is wrong because outbreakconfig is the CLI command for viewing and configuring Outbreak Filter settings such as enable/disable, thresholds, and message modification — as Nian noted, it "will only show existing filter rules" and pushes nothing new from Cisco. B is wrong because merely selecting Outbreak Filters only opens the settings page; it changes no values and downloads no rules, so it is a navigation step, not the completing action. C is wrong because backup and restore moves configuration and database contents between appliances and has no mechanism for contacting Cisco's update servers, a point devildog made when questioning how a restore could ever finish this configuration.Community Comment Notes
Most learners landed on D: dfb0b7d stated that you can "manually download updated outbreak rules from Cisco's update servers" with this control, and madboy2 dismissed the alternatives as making no sense. Nian drew the useful CLI distinction, explaining that outbreakconfig only displays existing filter rules while the actual download is performed by an update command, and Arian5431 pointed readers to the ESA 15.0 admin guide where the update control is documented. A small minority — devildog and kloug — argued for A, and while their objection to the backup/restore option is valid, A still only shows or edits filters already present rather than fetching replacements.Official Reference
Exam Strategy
When an email security question says the engineer must "manually" refresh rules and the options mix a GUI button with CLI commands, separate configuring filters from updating filters — only one action downloads new rules. Treat outbreakconfig as a settings command unless the option explicitly names a rule-update command such as outbreakupdate.
Frequently Asked Questions
Why is the outbreakconfig CLI command not the right step to update Outbreak Filter rules?
outbreakconfig only displays and configures existing Outbreak Filter settings on the appliance; it does not contact Cisco's update servers. The rule download is performed by the Update Rules Now action in the GUI.
Does Update Rules Now replace all Outbreak Filter rules or only outdated ones?
The refresh is incremental: AsyncOS compares local rule versions with Cisco's servers and downloads only changed rules, so up-to-date rules are retained as the question requires.