A network administrator reviews the file report for the last month and notices that all file types, except exe. show a disposition of unknown. What is the cause of this issue?

The issue described, where only .exe files have a disposition other than "unknown," points to a specific configuration within an active file policy. The Cisco Firepower system uses different engines for file analysis. Local Malware Analysis (historically known as Spero) is an engine that performs heuristic analysis on Portable Executable (PE) files, which includes .exe files. If a file policy is configured to enable only Local Malware Analysis but not AMP cloud lookups, the system will analyze .exe files locally. However, other file types like PDFs or documents cannot be analyzed by this engine and, without a cloud lookup to determine their reputation, will be assigned an "unknown" disposition.

A. The malware license has not been applied to the Cisco FTD. A missing malware (AMP) license would disable all file inspection and malware analysis features, meaning no files, including .exe, would be analyzed.
B. The Cisco FMC cannot reach the Internet to analyze files. Lack of internet connectivity would prevent AMP cloud lookups for all file types. This would result in all new, unseen files (including .exe) having an "unknown" disposition.
C. A file policy has not been applied to the access policy. If no file policy is applied to the matching access control rule, the system will not perform any file inspection, and therefore no file events or dispositions would be generated for any file type.

1. Cisco Firepower Management Center Configuration Guide

Version 7.0

Chapter: File Policies and Advanced Malware Protection

Section: Actions in File Rules.

Reference for Correct Answer (D): This section details the "Local Malware Analysis" action

stating

"Local malware analysis allows the system to inspect PE (Portable Executable) files for malware in an attempt to determine a file's disposition." This confirms the engine is specific to PE files like .exe. The guide also presents cloud lookups and dynamic analysis as separate

configurable options

supporting the scenario where only local analysis is enabled.

Reference for Incorrect Answer (C): The introduction to the "File Policies and Advanced Malware Protection" chapter states

"To perform any kind of file control or malware detection

you must associate a file policy with one or more access control rules." This confirms that without an applied policy

no file events would be generated

making option C incorrect.

2. Cisco Press

CCNP Security Identity

Management

and Automation SISE 300-715 and Securing Networks with Cisco Firepower SNCF 300-710 Official Cert Guide

1st Edition

Chapter 10: Advanced Malware Protection (AMP).

Reference for Correct Answer (D): The section on "File Disposition" explains

"The Firepower system can perform a local analysis of certain files to determine the likelihood that a file is malware. This feature is called local malware analysis (formerly Spero analysis). This feature applies only to PE files." This directly links the specific analysis type to .exe files

explaining the behavior noted in the question.