A network administrator reviews the file report for the last month and notices that all file types, except exe. show a disposition of unknown. What is the cause of this issue?

Question

Options

• AThe malware license has not been applied to the Cisco FTD.
• BThe Cisco FMC cannot reach the Internet to analyze files.
• CA file policy has not been applied to the access policy.
• DOnly Spero file analysis is enabled.

• A
  4% (1)
• B
  15% (4)
• C
  4% (1)
• D
  77% (20)

Explanation

Cisco FTD's file policy supports two analysis engines: Spero (a local, heuristic-based machine learning engine that runs on the FTD itself) and AMP cloud lookups (which send file hashes to the AMP cloud for a definitive clean/malware/unknown disposition). When only Spero analysis is enabled, the FTD performs local heuristic analysis. Spero produces a disposition for file types it has specific signatures/models for (like PE/EXE files), but for other file types it cannot produce a definitive result, so they show 'Unknown.' EXE files show a known disposition because the Spero engine has models for PE executables. If the malware license were missing (A) or the FMC couldn't reach the Internet (B), EXE files would also show Unknown. If no file policy were applied (C), no file events would appear at all.

No community discussion yet for this question.