Which two criteria must be used by the administrator to achieve this?

An email containing a URL passes through the Cisco ESA that has content filtering disabled for all mail policies. The sender is [email protected], the recipients are [email protected], [email protected], [email protected], and [email protected]. The subject of the email is Test Document395898847. An administrator wants to add a policy to ensure that the Cisco ESA evaluates the web reputation score before permitting this email.

Which two criteria must be used by the administrator to achieve this? (Choose two.)
A . Subject contains Test Document"
B . Sender matches test1.com
C . Email body contains a URL
D . Date and time of email
E . Email does not match [email protected]