A software reseller runs a two-week pilot that must record the malware disposition of every installer customers download over clear-text HTTP. Every transfer must finish, and every disposition must come from the cloud. Which file rule action meets the pilot requirements?
Select an answer to reveal the explanation.
Short Explanation
You can use a malware cloud lookup rule to send each file’s hash to the cloud and log the returned disposition while allowing the transfer to finish. That gives you the cloud-based results you need without interrupting downloads. You’ll then have file policy events to review for the pilot.
Full Explanation
The malware cloud lookup rule that queries the cloud by hash and logs each returned disposition meets the pilot requirements: it records a cloud-sourced result for each lookup without stopping the download, so every transfer can finish. A cloud hash-lookup rule that blocks installers deemed malicious fails the requirement that every transfer finish, even though it logs dispositions. A rule that logs malicious verdicts but allows clean and unknown installers fails because it omits the clean and unknown dispositions, so it does not document every installer. A rule that uses local analysis if cloud lookup fails can provide a result when the cloud is unavailable, but that locally generated result is not a cloud disposition. The exam caveat is to distinguish where a verdict comes from from where it is logged: recording an appliance-generated result does not make it cloud-sourced. In practice, verify that the rule covers all installer files downloaded over clear-text HTTP and does not interrupt transfers; then inspect the logs for clean, malicious, and unknown cloud responses, as well as lookup failures.