A security engineer found a suspicious file from an employee email address and is trying to upload it for analysis, however the upload is failing. The last registration status is still active. What…

Question

Options

• ACisco AMP for Networks is unable to contact Cisco Threat Grid on premise.
• BCisco AMP for Networks is unable to contact Cisco Threat Grid Cloud.
• CThere is a host limit set.
• DThe user agent status is set to monitor.

• A
  9% (3)
• B
  12% (4)
• C
  76% (26)
• D
  3% (1)

Explanation

Cisco Threat Grid (used for dynamic malware analysis/sandboxing) enforces submission limits, which include a maximum number of host registrations or daily/monthly file submissions depending on the license tier. When a 'host limit' is configured and reached, new file submissions are rejected even if the registration status shows 'active'-the active status simply means the existing registration/license is valid, not that submission capacity remains. The upload fails because the cap on registered hosts or submissions has been hit. Options A and B (connectivity issues to on-premise or cloud Threat Grid) would produce a connectivity error, not a limit-related failure. Option D (user agent set to monitor) is a status unrelated to submission limits.

No community discussion yet for this question.