An organization has had some malware infections recently and the management team wants to use Cisco Secure Firewall to enforce file policies to prevent malicious files from being downloaded. The…

The correct answer is A. Block Malware. Block Malware is correct because it specifically uses SHA-256 hash calculation combined with cloud-based threat intelligence (Cisco's AMP cloud) to identify and block only files confirmed as malware - exactly matching the scenario's requirement to compare hashes against known…

Submitted by wei.xz· Mar 30, 2026Content Security

Question

An organization has had some malware infections recently and the management team wants to use Cisco Secure Firewall to enforce file policies to prevent malicious files from being downloaded. The SHA-256 hash value of all files traversing the firewall must be calculated and compared to the hash values of known malware code. Which file rule action is used to block only the files that are confirmed to be malware?

Options

ABlock Malware
BDetect Files
CMalware Cloud Lookup
DBlock Files

How the community answered

(34 responses)

A
88% (30)
B
6% (2)
C
3% (1)
D
3% (1)

Explanation

Block Malware is correct because it specifically uses SHA-256 hash calculation combined with cloud-based threat intelligence (Cisco's AMP cloud) to identify and block only files confirmed as malware - exactly matching the scenario's requirement to compare hashes against known malicious code.

Detect Files (B) only logs and generates alerts for file transfers without blocking anything, making it useful for monitoring but not enforcement. Malware Cloud Lookup (C) performs the hash comparison and disposition lookup but does not block - it returns a verdict (clean/malware/unknown) without taking blocking action on its own. Block Files (D) blocks files based on type (e.g., all .exe files) regardless of whether they are actually malicious, which is a blunt instrument that doesn't rely on hash comparison to confirmed malware.

Memory tip: Think of it as a spectrum - Detect Files watches, Malware Cloud Lookup checks, and Block Malware is the only one that both checks the hash AND blocks confirmed threats. If the question mentions SHA-256 + confirmed malware, the answer is always Block Malware.

Topics

#Cisco Secure Firewall#File Policies#Malware Prevention#Threat Detection

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice