A file that was previously marked as "clean" has its disposition changed to "malware " Which FirePOWER feature license is required to enable analysis of the file propagation path within the network?

Question

Options

• AIPS
• BAVC
• CURL
• DAMP

• B
  6% (1)
• C
  6% (1)
• D
  89% (16)

Explanation

AMP (Advanced Malware Protection) is the correct answer because it is specifically designed to track and analyze file behavior over time, including retrospective security events - exactly what happens when a previously "clean" file is later reclassified as malware. AMP's file trajectory feature maps the propagation path of a file through the network, showing which hosts touched it and when.

Why the others are wrong:

• A. IPS (Intrusion Prevention System) inspects packets for exploit signatures but has no capability for file reputation tracking or retrospective analysis.
• B. AVC (Application Visibility and Control) identifies and controls application traffic - it does not perform malware analysis or track file movement.
• C. URL filtering controls access to web categories and reputation-based URLs, with no connection to file disposition changes or propagation tracking.

Memory tip: Think AMP = "After Malware Propagates" - it's the only license concerned with what happened to a file over time and across hosts, which is exactly what retrospective analysis and file trajectory require.

No community discussion yet for this question.