Exam 300-710 topic 1 question 62 discussion

B https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html#ID-2199-000005fa:~:text=identification%20of%20malware.-,Dynamic%20analysis,-Thorough%20analysis%20of

Only B. The sandbox env. in FMC is dynamic analysis. Spero is only for MSexe files.

MY Answer: A It is possible that A, "Malware analysis," could also be a valid option for further analyzing the file in the Talos cloud when an unknown verdict is encountered for a file detected by Cisco FTD. Malware analysis involves analyzing known malware to identify its characteristics and behavior, and this could also be useful in identifying unknown malware. However, sandbox analysis is generally considered to be a more comprehensive option for analyzing unknown files, as it involves executing the file in a controlled environment and monitoring its behavior to detect any malicious activity. So while A could be a valid option in some cases, C, "Sandbox analysis," is typically the more appropriate option for further analyzing unknown files in the Talos cloud.

Spero and dynamic analysis acomplish the file disposition and both goes to the cloud , but spero is only on exe files, the question says "a file", so i go to B

Shouldn't it be D. Spero Analysis. The file is analyzed in the Cloud. As for me, they are referencing AMP Cloud right?