An engineer receives multiple events on the Cisco Secure Firewall Threat Defense Manager (Firepower Management Center) showing that an 'Unknown' file was detected and caused an incident alert to be…

The correct answer is D. Upload the hash into Talos File Reputation Checker. Uploading the file hash to the Talos File Reputation Checker is the fastest, most direct way to check whether an unknown file is malicious - Talos is Cisco's global threat intelligence database that returns a reputation verdict (clean, malicious, unknown) for any file hash…

Threat Detection and Response

Question

An engineer receives multiple events on the Cisco Secure Firewall Threat Defense Manager (Firepower Management Center) showing that an 'Unknown' file was detected and caused an incident alert to be triggered. The engineer must determine if this event is malware or a legitimate file. Which action must be taken to check the reputation of the file?

Options

ADeploy Cisco Secure Malware Analysis (ThreatGrid).
BScan the file using Cisco Secure Endpoint (AMP) customer scan.
CView the identifier of the triggered action in Cisco Secure Firewall Threat Defense Manager (Firepower Management Center).
DUpload the hash into Talos File Reputation Checker.

How the community answered

(27 responses)

A
15% (4)
B
7% (2)
C
4% (1)
D
74% (20)

Explanation

Uploading the file hash to the Talos File Reputation Checker is the fastest, most direct way to check whether an unknown file is malicious - Talos is Cisco's global threat intelligence database that returns a reputation verdict (clean, malicious, unknown) for any file hash without needing to deploy new infrastructure or re-scan endpoints.

Why the distractors are wrong:

A (ThreatGrid): ThreatGrid performs dynamic sandboxed analysis of submitted files, not hash lookups - it's a heavier solution for deeper behavioral analysis, not a quick reputation check.
B (AMP customer scan): Cisco Secure Endpoint scans endpoints for active threats; it doesn't provide an on-demand reputation check for an arbitrary hash observed in FMC events.
C (FMC triggered action identifier): Viewing the action identifier in FMC tells you what rule fired, not the file's external reputation - that data stays within your own telemetry.

Memory tip: Think of Talos as Cisco's "Google search for file reputation" - you paste in a hash (MD5/SHA256) and get an instant global verdict. If FMC flags an unknown file and you need an external reputation check, Talos is always your first stop.

Topics

#File Reputation#Talos Intelligence#Malware Detection#Threat Analysis

Community Discussion

No community discussion yet for this question.

Full 350-201(NEW-127Q) Practice