Which AMP feature provides continuous analysis capabilities?

Question

Options

• Aretrospection
• Bfile reputation
• Cfile analysis
• Dsandboxing

• A
  93% (42)
• C
  4% (2)
• D
  2% (1)

Explanation

Retrospection is AMP's signature continuous analysis feature - it monitors files over time, even after they've been allowed into the network. If a file initially deemed safe later shows malicious behavior (e.g., new threat intelligence emerges), AMP retrospectively flags and alerts on it, enabling ongoing threat tracking rather than a single snapshot check.

Why the distractors are wrong:

• B. File reputation - A point-in-time lookup that checks a file's hash against a cloud database at the moment of detection; it does not continue monitoring afterward.
• C. File analysis - Refers to deeper inspection of unknown files (e.g., extracting metadata, behavior indicators), but this is also a one-time evaluation, not ongoing.
• D. Sandboxing - Executes suspicious files in an isolated environment to observe behavior, but only at a specific moment; it is not a continuous process.

Memory tip: Think of retrospection as "looking back" - AMP keeps watching history and can rewind to catch threats it missed the first time. If the question uses words like continuous, ongoing, or over time, the answer is retrospection.

No community discussion yet for this question.