The global setting that is configured under Cisco ESA Scan Behavior is the actions for unscannable messages due to attachment type. This setting allows the administrator to specify what action to take when a message contains an attachment that cannot be scanned by the appliance, such as encrypted or password-protected files. The possible actions are:
Deliver - Deliver the message normally.
Drop - Drop the message silently without notifying the sender or recipient.
Quarantine - Quarantine the message in a specified policy quarantine.
Bounce - Bounce the message back to the sender with a specified reason.
Reference:
Scan Behavior