Exam 350-701 topic 1 question 255 discussion

It should be Ethos Spero: A machine-learning based technology that proactively identifies threats that were previously unknown. Uses active heuristics to gather execution attributes Needs good data in large sets to tune Built to identify new malware Ethos: A generic signature capability, again ostensibly similar to the generic detection capabilities that some vendors provide. Directed at families of malware Can have more false-positives than 1-to-1 signatures

"detect different families of malware" = ETHOS See line diagram at page 109 in this PDF (page 120 according to page numbers) - it depicts sequence of AMP operations and their functions: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/R6BGArNQ/TECSEC-2599.pdf

Answer is D ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected.

ETHOS and SPERO are both considered generic engines. Because of this, the user has the ability to control how false positive-prone an ETHOS or SPERO hash is. ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected SPERO is the Cisco machine-based learning system. We use hundreds of features of a file, which we call a SPERO fingerprint. This is sent to the cloud and SPERO trees determine whether a file is malicious.

"ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected." Source: https://docs.amp.cisco.com/en/SecureEndpoint/Secure%20Endpoint%20User%20Guide.pdf

The correct answer is D http://www.download.safeplus.pl/Prezentacje/Cisco%20Live%20San%20Diego%202015/BRKSEC-2139.pdf

The correct answer is D http://www.download.safeplus.pl/Prezentacje/Cisco%20Live%20San%20Diego%202015/BRKSEC-2139.pdf

Dynamic analysis is a snadboxing technique. Answer should be D https://www.cisco.com/web/KR/events/CiscoConnect/2014/downloads/Day2_Track5-1.pdf

C is correct. https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html#ID-2199-000005d8