If you have all IWSVA scanning, blocking, and filtering enabled, the
general order of process is:
URL (the URL
is checked against Quota, blocking rules, and filtering policies)
Size (files
are checked against size limits set in HTTP
> HTTP Malware Scan)
Extension (file
is evaluated based on extension)
Type (file is
evaluated based on file property rather than extension)