As an administrator, you need to research why an email was sent instead of being...

The correct answer is Smart Search because Smart Search is the administrative investigation tool used to review message handling, trace processing outcomes, and identify the final rule that determined disposition. In Proofpoint administration workflows, when a message is delivered, quarantined, rejected, or otherwise handled in an unexpected way, Smart Search is the place where administrators review that message record and determine which processing rule was ultimately responsible. Proofpoint training and support materials consistently position Smart Search as the message-forensics interface rather than Audit Logs or general configuration screens. Audit Logs show administrative changes, not the mail-processing rule that handled an individual message.

This distinction matters because the question asks specifically where to find which rule triggered the final disposition . That is message-level evidence, not system-change evidence. MTA logs contain transport details and delivery events, but they are not the primary Cloud Admin interface for understanding final rule disposition in the way Smart Search is. Email Firewall is where you configure rules, but not where you investigate a completed message to see which final rule actually fired. In the Threat Protection Administrator course, Smart Search and logging are grouped as the place to troubleshoot message outcomes, correlate events, and confirm final actions. Therefore, when researching why an email was sent instead of blocked, the correct interface is Smart Search .