Cisco ESA AMP File Upload Behavior Under Network Congestion

350-701 By islever Editorial Last updated

Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities

Short answer

B The file upload is abandoned because the appliance will not retry uploads that fail due to connectivity problems such as network congestion.

Question

A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How
will the Cisco ESA handle any files which need analysis?
  1. The ESA immediately makes another attempt to upload the file.
  2. The file upload is abandoned. Correct Answer
  3. AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.
  4. The file is queued for upload when connectivity is restored

Key Takeaways

The exam tests the distinction between server overload (which may trigger a retry) and connectivity/network problems (which cause immediate failure), a common trap for candidates assuming all failures are retried.

This question tests the Cisco Email Security Appliance (ESA) behavior when uploading files to Advanced Malware Protection (AMP) fails due to network congestion. The correct answer is B, as connectivity issues result in abandoned uploads rather than retries or queuing.

Common mistake: Candidates often choose C or D, incorrectly assuming that the ESA caches the file hash and retries later or queues the upload until connectivity is restored. This ignores the specific documentation stating that connectivity failures prevent upload.

Expert Analysis

Why the Answer Is Correct

According to Cisco's official technical note for the ESA (Doc ID 118796), the appliance attempts to upload a file once. If the upload fails due to connectivity problems—such as network congestion affecting communication—the file is not uploaded. The text explicitly states: "if upload is not successful, for example because of connectivity problems, the file may not be uploaded." Therefore, option B is the correct behavior.

Why the Other Options Are Wrong

Option A is incorrect because the ESA does not immediately make another attempt upon connectivity failure; it only retries if the server is overloaded, not if the network is down. Option C is incorrect because while the SHA-256 fingerprint is used for reputation checks, the file itself is not cached locally for periodic re-upload attempts in this scenario; the upload action is aborted. Option D is incorrect because there is no queuing mechanism for file uploads to AMP in the ESA configuration; if the connection fails, the process stops.

Community Comment Notes

Many users initially voted for C or D, believing the system would retry. However, several comments correctly identified B by citing the specific Cisco documentation. User Seawanderer noted the exact phrasing from the tech note regarding connectivity problems leading to non-upload. User kerniger also confirmed B based on the same source. Some users like bob511 argued for C based on general AMP hash caching behavior, but missed the specific constraint of 'network congestion' causing upload failure.

Official Reference

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When studying ESA AMP integration, memorize the specific error handling behaviors: connectivity failures abort the upload, while server overloads may trigger a single retry. Do not assume standard retry logic applies to all failure modes.

Frequently Asked Questions

Does Cisco ESA retry file uploads if the network is congested?

No. According to Cisco docs, if the upload fails due to connectivity problems, the file may not be uploaded at all. Retries are reserved for server overload scenarios.

What happens to the SHA-256 hash if the file upload fails?

While hashes are used for reputation checks, the file itself is not queued or cached for re-upload if the initial transfer fails due to network issues.

More 350-701 FAQ →

Discussion 21 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 21

  1. Seawanderer 👍 19
    I'm not really sure about the answer, but it could be B "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.' https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
  2. kerniger 👍 14
    its B "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more." https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
  3. lucky2205 👍 7 Answered B
    its B the question clearly states that "The network is congested and is affecting communication." & its mentioned in ESA configuration guide "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded." https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
  4. bob511 👍 6
    Cisco ESA adds a record of the SHA256 of this file to its internal database, where it is kept for up to 12 hours, and starts periodically querying if the analysis was complete, until it receives a positive response back from the file analysis service i think C
  5. kapplejacks 👍 6
    There is NO (Zero) file upload, only a hash exchange making answer C the only correct answer.
Show 16 more comments
  1. kapplejacks 👍 5
    Cisco likes to do this, do not go down the path they are leading where they want you to over think. They would have said the file analysis server was overloaded if they wanted you to know about periodic upload. This question test your ability to know how AMP communicates about file reputation.
  2. eazy99 👍 3
    I actually believe the answer is D. I got it from Cisco website, here is the paragraph “The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.“ Please feel free to correct me if you think it’s not. This is the link: You will find it as the second point where they say Highly Important Notes: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html#anc1
  3. Mulema 👍 3
    The correct answer to me even is D. The first part of the question is just noise to distract. The emphasis to me is the second half of the question - How will Cisco ESA handle any files which need analysis? The Cisco ESA will not abandon the file upload. Instead, it will continue to attempt to upload the file until communication is restored. If the file is still not uploaded after a certain period of time, the Cisco ESA will cache the file and continue to attempt to upload it periodically https://bard.google.com/chat/e3b8e30fe3160083
  4. Anonymous983475 👍 3 Answered C
    The AMP first tries to compare file's hash to the cloud DB and if there is no such file it tries to upload it. It will retry if the upload fails.
  5. Sarbi 👍 2
    What about A. Highlighting important notes: If a file has recently been uploaded from any source, the file will not be uploaded again. For file analysis results for this file, search for the SHA-256 from the File Analysis reporting page. The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.
  6. Bandito 👍 2 Answered B
    There is a video from a Cisco engineer. https://youtu.be/WD7UD70e2mo?t=453 I believe the answer is B.
  7. eazy99 👍 2
    I apologize, I meant A not D.
  8. XBfoundX 👍 1 Answered B
    The statement is clear: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html looking in the notes is specified: Highlighting important notes: If a file has recently been uploaded from any source, the file will not be uploaded again. For file analysis results for this file, search for the SHA-256 from the File Analysis reporting page. The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.
  9. itsklk 👍 1 Answered A
    Read this : https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html#anc5 Highlighting important notes: If a file has recently been uploaded from any source, the file will not be uploaded again. For file analysis results for this file, search for the SHA-256 from the File Analysis reporting page. The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.
  10. ddev3737_111 👍 1
    The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more
  11. psuoh 👍 1
    " If the failure was because the file analysis server was overloaded the upload will be attempted once more. " The network is congested as the question points out. The question doesnt mention about the analysis server being overloaded.
  12. Demon_Queen_Velverosa 👍 1
    The network is congested in this case so that means connectivity problems are occurring and so as many people have wrote but not emphasized. Theresa will drop the file and not upload it again because of connectivity issues.
  13. Demon_Queen_Velverosa 👍 1
    Network congestion is a network connectivity issue as packets are being dropped because the network devices can’t handle the absurd amount of network traffic.
  14. CyberGhost666 👍 1 Answered B
    Network congestion is categorized as a connectivity problem, so ESA performs one upload attempt and then drops the file, not retrying it later.
  15. sis_net_sec 👍 1 Answered A
    https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
  16. pohqinan 👍 1
    Agree With this.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide