How does the Cisco WSA choose which scanning engine verdict to use when there is more than one verdict?

The correct answer is B. based on the most restrictive verdict. When the Cisco WSA uses multiple scanning engines (such as Sophos, McAfee, and AMP) and they return conflicting verdicts on the same piece of content, the WSA always applies the most restrictive verdict. This security-first design ensures that if any single engine identifies cont

Malware Defense

Question

Options

Abased on the least restrictive verdict
Bbased on the most restrictive verdict
Cbased on the first verdict returned
Dbased on the last verdict returned

How the community answered

(54 responses)

A
2% (1)
B
93% (50)
C
2% (1)
D
4% (2)

Explanation

When the Cisco WSA uses multiple scanning engines (such as Sophos, McAfee, and AMP) and they return conflicting verdicts on the same piece of content, the WSA always applies the most restrictive verdict. This security-first design ensures that if any single engine identifies content as malicious or suspicious, that determination takes precedence over a clean verdict from another engine. For example, if one engine returns 'clean' and another returns 'malware,' the WSA will block or quarantine the content. This prevents a single engine's miss from allowing harmful content through.

Topics

#Cisco WSA#Scanning Engine#Verdict Resolution#Malware Defense

Community Discussion

No community discussion yet for this question.

Full 300-725 Practice