Which of the following descriptions of the email content filtering operating mechanism is incorrect?

Which of the following descriptions of the email content filtering operating mechanism is incorrect?
A . The firewall first needs to identify the traffic to be filtered based on matching conditions.
B . When a POP3 or IMAP message is detected, if it is determined to be an illegal email, the firewall’s response action can be to send an alarm message or block the email.
C . Email content filtering is only detected in the outbound direction
D . After the firewall filters out email traffic, it then checks the email address and attachment size to identify illegal emails.

Answer: C