An engineer is troubleshooting a file that is being blocked by a Cisco FTD device on the network.
The user is reporting that the file is not malicious.
Which action does the engineer take to identify the file and validate whether or not it is malicious?

Question

An engineer is troubleshooting a file that is being blocked by a Cisco FTD device on the network.

The user is reporting that the file is not malicious.

Which action does the engineer take to identify the file and validate whether or not it is malicious?

Bhavya AGGARWAL · Accepted Answer

identify the file in the intrusion events and submit it to Threat Grid for analysis.

Bhavya AGGARWAL · Answer

Use FMC file analysis to look for the file and select Analyze to determine its disposition.

Bhavya AGGARWAL · Answer

Use the context explorer to find the file and download it to the local machine for investigation.

Bhavya AGGARWAL · Answer

Right click the connection event and send the file to AMP for Endpoints to see if the hash is malicious.

List of questions