Exam 300-745 Topic 3 Question 6 Discussion

Based on the provided exhibits, the correct firewall feature for blocking malware in this context isFile Inspection.
Inimage_4c047c.png, we see a Cisco Secure Firewall Access Control Policy rule named "Default Inspect".
This rule is configured to allow traffic from the "inside" zone to the "outside" zone while applying deep packet inspection. Crucially, the configuration includes aFile Policyfield, which is the mechanism used to perform malware analysis and file disposition lookups. By associating a File Policy with an Access Control rule, the firewall can inspect files as they transit the network, calculate their SHA-256 hash, and query the Cisco Collective Security Intelligence cloud to determine if the file is malicious, clean, or unknown.
The evidence of this feature in action is found inimage_4b1ebe.png, which shows theCisco Secure Endpoint (formerly AMP for Endpoints) Device Trajectory. The "Activity Details" pane specifically identifies a malicious file (iodnxvg.exe) categorized asW32.DFC.MalParent. While the log notes the file was not quarantined because it was in "audit only mode," the underlying technology performing the detection isFile Inspection. This feature provides the necessary visibility into the contents of encrypted or unencrypted data streams to identify and-when properly configured in a "Protect" or "Block" mode-stop the execution of malware. This aligns with the Cisco SDSI objective of building a layered defense that combines perimeter traffic control with granular file-level security.