A SOC lead wants the Secure Firewall Management Center to show that a file allowed last week turned malicious later, alongside that file's movement across network hosts and managed endpoints, all tied to firewall events. Which integration delivers those two views inside the Management Center?

The Secure Endpoint integration is correct because it brings both required views into Secure Firewall Management Center: retrospective events can record that a previously allowed file later received a malicious verdict, and file trajectory can show the file’s movement across network hosts and managed endpoints in context with firewall events. Integrating Secure Malware Analytics with FMC can provide retrospective verdicts, and FMC file events can show network-host observations, but that pairing does not provide the required movement across managed endpoints. Enabling Secure Endpoint file trajectory and correlating its records with firewall events supplies the movement view, but without retrospective verdicting it cannot show that a file allowed earlier later became malicious. Configuring Secure Endpoint retrospective events and trajectory but reviewing them in the Secure Endpoint console provides both types of information there, yet fails the requirement that both views be available inside Management Center alongside firewall events. Exam caveat: a verdict update by itself is not proof of a complete retrospective event or trajectory; the integration and relevant telemetry must be enabled. Practical check: in FMC, verify that a known file has a retrospective event, a trajectory containing network-host and managed-endpoint observations, and associated firewall events.