Which two benefits does AMP provide compared to the other scanning engines on the Cisco WSA? (Choose two.)

Cisco Advanced Malware Protection (AMP) for Web Security enhances the capabilities of the Cisco WSA beyond traditional signature-based scanning engines (like Sophos or McAfee). AMP's primary advantage is its ability to combat advanced threats. It uses file reputation, sandboxing via Cisco Threat Grid for dynamic analysis of unknown files, and retrospective security. This architecture is specifically designed to identify and block previously unseen, or "zero-day," attacks. It is also highly effective against targeted file-based attacks, which often employ custom malware crafted to evade conventional signature-based defenses.

A. protection against malware: This is too generic. Traditional antivirus engines also provide protection against known malware, making this not a comparative benefit of AMP.

C. protection against spam: This is not a function of AMP. Spam filtering is handled by dedicated anti-spam engines or email security appliances.

D. protection against viruses: This is a basic capability of all antivirus/antimalware engines on the WSA, not a unique advantage of AMP.

1. Cisco Web Security Appliances User Guide

AsyncOS 14.5

Chapter: Protecting Against Malware and Malicious or Unwanted Content

Section: About Advanced Malware Protection.

"Advanced Malware Protection (AMP) helps to detect and block malware in files downloaded from the web... It is particularly effective against targeted and zero-day attacks." This statement directly supports options B and E as the key differentiators.

2. Cisco Web Security Appliance Best Practices Guide

Section: Advanced Malware Protection (AMP).

"Traditional anti-malware solutions are based on point-in-time detection... However

advanced malware can often evade this initial detection... AMP provides protection across the attack continuum... before

during

and after an attack... by using continuous analysis and retrospective security." This explains the mechanism by which AMP addresses advanced threats like zero-day and targeted attacks

which other engines miss.

3. Cisco Content Security Management Appliance Configuration Guide

14.0

Chapter: File Reputation and Analysis

Section: File Analysis.

"File analysis provides advanced threat detection of unknown files by executing them in a sandbox and analyzing their behavior to determine the file’s threat level." This describes the sandboxing capability used to identify the malicious behavior characteristic of zero-day attacks.