Exam 300-710 topic 1 question 134 discussion

I believe the correct answers are A and E. Bobster is referencing local malware analysis requirements, but we have no information that local malware analysis is begin used. By default theat grid is used, and threat grid needs no configuration on the FMC to connect to the cloud. The question states "which configuration tasks" - we dont need to do anything related to threat grid afaik. Also, if all file downloads going through the firewall are encrypted, then C and E would accomplish nothing.

A. The Cisco FMC needs to include a SSL decryption policy. > NO, this is Optional B. The Cisco FMC needs to connect to the Cisco AMP for Endpoints service. > NO these connect to "secure endpoint console", not to FMC. Tointegrate with AMP, they can send their data to AMP cloud (private or public),but not to FMC C. The Cisco FMC needs to connect to the Cisco ThreatGrid service directly for sandboxing. > NO direct connection is needed. Connection through a proxy is also possible D. The Cisco FMC needs to connect with the FireAMP Cloud. > YES - cloud can be private or public, but a connection IS required E. The Cisco FMC needs to include a file inspection policy for malware lookup. > YES - without filie policies, no files will be scanned. https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/file_policies_and_advanced_malware_protection.html#ID-2193-00000132

A: because you can't inspect any traffic that it's encrypted ( majority of the traffic ): You can use SSL decryption policies to turn encrypted traffic into plain text traffic, so that you can then apply URL filtering, intrusion and malware control

Option E is mandatory. A can be, but not necessary (i still can inspect malware in http and ftp protocols whitout ssl inspection) C seems more precise. Cisco Threat Grid runs the file in a sandbox environment, analyzes the file's behavior to determine whether the file is malicious, and returns a threat score that indicates the likelihood that a file contains malware. From the threat score, you can view a dynamic analysis summary report with the reasons for the assigned threat score. You can also look in Cisco Threat Grid to view detailed reports for files that your organization submitted, as well as scrubbed reports with limited data for files that your organization did not submit. https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/file_policies_and_advanced_malware_protection.html

Make most sense.

D&E - the operative key in the question: "To achieve this file lookup". SSL decryption is not needed to perform the lookup. SSL Decryption -To be able to test the traffic if encrypted--yes but not to perform the lookup.

The two configuration tasks that must be performed in order to use Cisco FMC to determine if files being sent through the network are malware are: E. The Cisco FMC needs to include a file inspection policy for malware lookup. B. The Cisco FMC needs to connect to the Cisco AMP for Endpoints service. Explanation: E. The Cisco FMC needs to include a file inspection policy for malware lookup: A file inspection policy can be used to inspect and analyze files that are transmitted over the network to determine if they contain malware. By configuring a file inspection policy in Cisco FMC, you can specify the types of files that should be inspected, the types of malware to look for, and the actions to take when malware is detected. B. The Cisco FMC needs to connect to the Cisco AMP for Endpoints service: By connecting to the Cisco AMP for Endpoints service, Cisco FMC can leverage the advanced threat intelligence provided by AMP to analyze and identify potential malware threats in network traffic.

You dont NEED SSL decryption, as files can be transmitted over literally any port in cleartext. You also dont need sandboxing, but what you DO need is a connection to the public AMP or a private AMP cloud. So Im choosing DE

I think its C and D. Please take a look at this ciscolive doc at page 22 https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/BRKSEC-2890.pdf

Correct answer : C and E

Correct answer is: C and E

A & E You need to decrypt the traffic

B and E The Cisco FMC needs to connect to the Cisco AMP for Endpoints service.

A and E. Focusing on configurations needed.

The correct answer is A and E.

I would go with original C and E. Cisco configuration guide stipulates that: Local malware analysis does not require establishing communications with the Cisco Threat Grid cloud. However, you must configure communications with the cloud to submit files pre classified as malware for dynamic analysis, and to download updates to the local malware analysis rule set.

I would chose A and E