A hospital turns on Secure Malware Defense in the Management Center and attaches a file policy to its outbound internet rule. A brand-new executable arrives that no signature set has recorded, and the team expects it blocked once Cisco's cloud marks it malicious. Which component supplies the file disposition that the sensor enforces?
Select an answer to reveal the explanation.
Short Explanation
The file policy is only the referee, so the verdict has to come from somewhere else. A malware lookup asks Cisco's cloud about the hash, and that returned disposition decides the block you'll see in the file event.
Full Explanation
The file policy decides what happens to a transfer, but the judgment about the file itself comes from Secure Malware Defense asking Cisco's cloud. When a file matches the policy, the appliance sends file metadata and its hash for a lookup, the cloud answers with a disposition, and the policy enforces that verdict by blocking or allowing the connection. Because the sample is brand-new, only that cloud reputation can label it, which is why the lookup is the piece the requirement turns on. Signature-driven intrusion inspection fails here because a novel executable has no matching Snort file signature to trigger. URL filtering judges the site serving the download rather than the bytes of the file itself, so a legitimate site delivering a poisoned file passes. A DNS policy works before any transfer begins and operates at the domain level, so it can never produce a file disposition for a sample already in flight. Exam caveat: the appliance needs outbound reachability to the cloud for a lookup to return, and the file policy must be attached to an access control rule. Practical check: after a test transfer, open the file event view and confirm the disposition and the policy action recorded for that file.