350-601 · Question #323
A network administrator is using the Cisco ESA with Cisco AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any…
The correct answer is A. Cisco AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload. When network congestion affects Cisco ESA's ability to upload files for AMP analysis, the ESA calculates the file's SHA-256 fingerprint, caches it, and periodically attempts the upload.
Question
A network administrator is using the Cisco ESA with Cisco AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?
Options
- ACisco AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.
- BThe Cisco ESA immediately makes another attempt to upload the file.
- CThe file is queued for upload when connectivity is restored.
- DThe file upload is abandoned.
How the community answered
(38 responses)- A87% (33)
- B3% (1)
- C3% (1)
- D8% (3)
Why each option
When network congestion affects Cisco ESA's ability to upload files for AMP analysis, the ESA calculates the file's SHA-256 fingerprint, caches it, and periodically attempts the upload.
When a Cisco ESA integrated with Cisco AMP experiences network congestion, it calculates the SHA-256 hash of the file, caches this fingerprint locally, and then periodically re-attempts the upload to the AMP cloud for verdict lookup or detailed analysis, ensuring eventual processing without losing context.
Immediately making another attempt might exacerbate network congestion and is not the sophisticated retry mechanism employed by Cisco AMP.
While queuing is involved, the more specific and accurate mechanism includes calculating and caching the fingerprint and then periodically attempting the upload, not simply waiting for connectivity to be restored.
The file upload is not abandoned; Cisco AMP is designed to ensure files are eventually analyzed through retries and fingerprint caching.
Concept tested: Cisco ESA AMP file analysis during congestion
Source: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100.html
Topics
Community Discussion
No community discussion yet for this question.