nerdexam
Cisco

350-601 · Question #323

A network administrator is using the Cisco ESA with Cisco AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any…

The correct answer is A. Cisco AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload. When network congestion affects Cisco ESA's ability to upload files for AMP analysis, the ESA calculates the file's SHA-256 fingerprint, caches it, and periodically attempts the upload.

Security

Question

A network administrator is using the Cisco ESA with Cisco AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?

Options

  • ACisco AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.
  • BThe Cisco ESA immediately makes another attempt to upload the file.
  • CThe file is queued for upload when connectivity is restored.
  • DThe file upload is abandoned.

How the community answered

(38 responses)
  • A
    87% (33)
  • B
    3% (1)
  • C
    3% (1)
  • D
    8% (3)

Why each option

When network congestion affects Cisco ESA's ability to upload files for AMP analysis, the ESA calculates the file's SHA-256 fingerprint, caches it, and periodically attempts the upload.

ACisco AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.Correct

When a Cisco ESA integrated with Cisco AMP experiences network congestion, it calculates the SHA-256 hash of the file, caches this fingerprint locally, and then periodically re-attempts the upload to the AMP cloud for verdict lookup or detailed analysis, ensuring eventual processing without losing context.

BThe Cisco ESA immediately makes another attempt to upload the file.

Immediately making another attempt might exacerbate network congestion and is not the sophisticated retry mechanism employed by Cisco AMP.

CThe file is queued for upload when connectivity is restored.

While queuing is involved, the more specific and accurate mechanism includes calculating and caching the fingerprint and then periodically attempting the upload, not simply waiting for connectivity to be restored.

DThe file upload is abandoned.

The file upload is not abandoned; Cisco AMP is designed to ensure files are eventually analyzed through retries and fingerprint caching.

Concept tested: Cisco ESA AMP file analysis during congestion

Source: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_0100.html

Topics

#Cisco ESA/AMP Integration#Malware Analysis#File Analysis Resilience#SHA-256

Community Discussion

No community discussion yet for this question.

Full 350-601 Practice