Proofpoint TPAD01 Exam - Topic 11 Question 16 Discussion

The correct answer is C. The inbound_protected and default policy will be applied to the message in that order.

From the exhibit, the message is inbound and matches two policy routes:

legal

default_inbound

The inbound_protected virus policy is configured with Allow: legal, so that policy applies to this message first. The default virus policy is configured with Allow: default_inbound, so it also applies to the same message. Since the message matches both routes, both policies are applied in policy order, with the more specific matching inbound policy applying before the default policy.

Why the other choices are incorrect:

A is incorrect because the message is inbound, not outbound, so the outbound policy is not the first applicable policy here.

B is incorrect because the exhibit logic indicates the specific matched inbound policy applies before the default policy, not the reverse.

D is incorrect because the exhibit shows the message belongs to both legal and default_inbound, so the default policy is not ignored.

This is a Virus Protection policy-order question. The important concept is that Proofpoint can apply multiple matching virus policies based on route membership, and in this scenario the message is processed by inbound_protected first, followed by default.

So the complete interpretation of the exhibit is that the inbound_protected and default policies are both applied, in that order, which makes Answer C the verified course-aligned choice.