A network administrator discovers that a user connected to a file server and downloaded a malware file. The Cisc FMC generated an alert for the malware event, however the user still remained…

The correct answer is D. Reset Connection. Cisco recommends that you enable Reset Connection for the Block Files and Block Malware actions to prevent blocked application sessions from remaining open until the TCP connection resets. If you do not reset connections, the client session will remain open until the TCP…

Configuration

Question

A network administrator discovers that a user connected to a file server and downloaded a malware file. The Cisc FMC generated an alert for the malware event, however the user still remained connected. Which Cisco APM file rule action within the Cisco FMC must be set to resolve this issue?

Options

ADetect Files
BMalware Cloud Lookup
CLocal Malware Analysis
DReset Connection

How the community answered

(49 responses)

A
2% (1)
B
10% (5)
C
4% (2)
D
84% (41)

Explanation

Cisco recommends that you enable Reset Connection for the Block Files and Block Malware actions to prevent blocked application sessions from remaining open until the TCP connection resets. If you do not reset connections, the client session will remain open until the TCP connection resets itself.

Topics

#Cisco FMC#AMP for Networks#File Policy#Security Enforcement

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice