350-701 Content Security Practice Question
A SOC analyst notices that a user downloaded a malicious file from a website. The Cisco WSA is configured with AMP file scanning. However, the file was not blocked. Which scenario best explains why AMP failed to detect the file?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was a zero-day malware not yet analyzed by AMP
AMP uses SHA-256 cloud lookup and sandboxing. If the file is new and unknown (zero-day), the cloud may not have a disposition, and if sandboxing is not enabled or the file type is not analyzed, it could be allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The file was a zero-day malware not yet analyzed by AMP
Why this is correct
Correct. Zero-day files may not have a known reputation and could be allowed.
- ✗
The file was cached from a previous scan
Why it's wrong here
Caching would still have a disposition if previously scanned.
- ✗
The file was less than 10 KB
Why it's wrong here
File size is not a typical reason for AMP to miss detection.
- ✗
SSL decryption was disabled
Why it's wrong here
If the download was over HTTPS, decryption would be needed to inspect the file. But if decryption was disabled, AMP might not see the file at all.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.