A content filtering policy with "Disable decomposition of files in list" set to "Archive Files" may generate a false positive when processing password protected archive files.
 

Although decompisition of archive attachments has been disabled, the archive inventory is accessible and rules written to match filenames will be tested against the archive inventory. Even though the archive has not been decomposed, this may result in a false match when a filename test matches the archive inventory. This issue only affects password protected zip files.

This is a known issue and will be addressed with a future release.