A logistics firm enables internet breakout at branches and must block malicious downloads and stop known-bad files from executing, with verdicts refreshed from cloud intelligence. Branch routers have security licensing and limited bandwidth. Which WAN Edge advanced malware protection behavior should the engineer describe to meet file-based threat defense?

The correct behavior centers on AMP file reputation because branch internet breakout requires direct inspection of files retrieved from the internet, and hashing at the Edge provides a bandwidth-efficient enforcement point that still leverages cloud intelligence for verdicts on known-bad content, enabling both download blocking and execution prevention without transferring entire files. URL filtering with cloud categorization is valuable for preventing access to risky domains and reducing download attempts, yet it operates at the domain and URL layer and cannot evaluate file hashes or enforce execution control once a payload is in transit. IPS with cloud-updated signatures is essential for blocking network exploits and vulnerability-driven attacks in transit, yet it matches traffic patterns for intrusion activity rather than computing file disposition from reputation services. Cloud sandbox analysis that uploads full files for detonation is powerful for unknown and zero-day investigation, yet it consumes significant bandwidth and adds latency for branches with constrained links, whereas reputation lookup resolves known threats with a lightweight hash query. For exam purposes, distinguish reputation for known files versus sandboxing for unknown files, since scenarios with limited bandwidth often test efficient cloud lookup. In practice, verify security licensing is active on the WAN Edge, confirm reliable cloud connectivity for reputation queries, and validate with a safe test file that malicious verdicts correctly trigger block actions with proper logging.