Cisco ESA AMP File Upload Behavior Under Network Congestion
Describe network security solutions and deployment models that provide intrusion prevention and firewall capabilities
Answer
Correct answer: B — The file upload is abandoned because the appliance will not retry uploads that fail due to connectivity problems such as network congestion.
A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?
Community Insight
The exam tests the distinction between server overload (which may trigger a retry) and connectivity/network problems (which cause immediate failure), a common trap for candidates assuming all failures are retried.
This question tests the Cisco Email Security Appliance (ESA) behavior when uploading files to Advanced Malware Protection (AMP) fails due to network congestion. The correct answer is B, as connectivity issues result in abandoned uploads rather than retries or queuing.
Candidates often choose C or D, incorrectly assuming that the ESA caches the file hash and retries later or queues the upload until connectivity is restored. This ignores the specific documentation stating that connectivity failures prevent upload.
Community Discussion (21 comments)
XBfoundX
👍 1
Selected: B
The statement is clear: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html looking in the notes is specified: Highlighting important notes: If a file has recently been uploaded from any source, the file will not be uploaded again. For file analysis results for this file, search for the SHA-256 from the File Analysis reporting page. The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.
CyberGhost666
👍 1
Selected: B
Network congestion is categorized as a connectivity problem, so ESA performs one upload attempt and then drops the file, not retrying it later.
Demon_Queen_Velverosa
👍 1
The network is congested in this case so that means connectivity problems are occurring and so as many people have wrote but not emphasized. Theresa will drop the file and not upload it again because of connectivity issues.
Demon_Queen_Velverosa
👍 1
Network congestion is a network connectivity issue as packets are being dropped because the network devices can’t handle the absurd amount of network traffic.
Mulema
👍 3
The correct answer to me even is D. The first part of the question is just noise to distract. The emphasis to me is the second half of the question - How will Cisco ESA handle any files which need analysis? The Cisco ESA will not abandon the file upload. Instead, it will continue to attempt to upload the file until communication is restored. If the file is still not uploaded after a certain period of time, the Cisco ESA will cache the file and continue to attempt to upload it periodically https://bard.google.com/chat/e3b8e30fe3160083
Bandito
👍 2
Selected: B
There is a video from a Cisco engineer. https://youtu.be/WD7UD70e2mo?t=453 I believe the answer is B.
itsklk
👍 1
Selected: A
Read this : https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html#anc5 Highlighting important notes: If a file has recently been uploaded from any source, the file will not be uploaded again. For file analysis results for this file, search for the SHA-256 from the File Analysis reporting page. The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.
ddev3737_111
👍 1
The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more
Anonymous983475
👍 3
Selected: C
The AMP first tries to compare file's hash to the cloud DB and if there is no such file it tries to upload it. It will retry if the upload fails.
sis_net_sec
👍 1
Selected: A
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
lucky2205
👍 7
Selected: B
its B the question clearly states that "The network is congested and is affecting communication." & its mentioned in ESA configuration guide "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded." https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
bob511
👍 6
Cisco ESA adds a record of the SHA256 of this file to its internal database, where it is kept for up to 12 hours, and starts periodically querying if the analysis was complete, until it receives a positive response back from the file analysis service i think C
eazy99
👍 3
I actually believe the answer is D. I got it from Cisco website, here is the paragraph “The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.“ Please feel free to correct me if you think it’s not. This is the link: You will find it as the second point where they say Highly Important Notes: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html#anc1
psuoh
👍 1
" If the failure was because the file analysis server was overloaded the upload will be attempted once more. " The network is congested as the question points out. The question doesnt mention about the analysis server being overloaded.
eazy99
👍 2
I apologize, I meant A not D.
kapplejacks
👍 6
There is NO (Zero) file upload, only a hash exchange making answer C the only correct answer.
kapplejacks
👍 5
Cisco likes to do this, do not go down the path they are leading where they want you to over think. They would have said the file analysis server was overloaded if they wanted you to know about periodic upload. This question test your ability to know how AMP communicates about file reputation.
kerniger
👍 14
its B "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more." https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
Sarbi
👍 2
What about A. Highlighting important notes: If a file has recently been uploaded from any source, the file will not be uploaded again. For file analysis results for this file, search for the SHA-256 from the File Analysis reporting page. The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.
Seawanderer
👍 19
I'm not really sure about the answer, but it could be B "The appliance will try once to upload the file; if upload is not successful, for example because of connectivity problems, the file may not be uploaded. If the failure was because the file analysis server was overloaded, the upload will be attempted once more.' https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
pohqinan
👍 1
Agree With this.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
According to Cisco's official technical note for the ESA (Doc ID 118796), the appliance attempts to upload a file once. If the upload fails due to connectivity problems—such as network congestion affecting communication—the file is not uploaded. The text explicitly states: "if upload is not successful, for example because of connectivity problems, the file may not be uploaded." Therefore, option B is the correct behavior.Why the Other Options Are Wrong
Option A is incorrect because the ESA does not immediately make another attempt upon connectivity failure; it only retries if the server is overloaded, not if the network is down. Option C is incorrect because while the SHA-256 fingerprint is used for reputation checks, the file itself is not cached locally for periodic re-upload attempts in this scenario; the upload action is aborted. Option D is incorrect because there is no queuing mechanism for file uploads to AMP in the ESA configuration; if the connection fails, the process stops.Community Comment Notes
Many users initially voted for C or D, believing the system would retry. However, several comments correctly identified B by citing the specific Cisco documentation. User Seawanderer noted the exact phrasing from the tech note regarding connectivity problems leading to non-upload. User kerniger also confirmed B based on the same source. Some users like bob511 argued for C based on general AMP hash caching behavior, but missed the specific constraint of 'network congestion' causing upload failure.Official Reference
Exam Strategy
When studying ESA AMP integration, memorize the specific error handling behaviors: connectivity failures abort the upload, while server overloads may trigger a single retry. Do not assume standard retry logic applies to all failure modes.
Frequently Asked Questions
Does Cisco ESA retry file uploads if the network is congested?
No. According to Cisco docs, if the upload fails due to connectivity problems, the file may not be uploaded at all. Retries are reserved for server overload scenarios.
What happens to the SHA-256 hash if the file upload fails?
While hashes are used for reputation checks, the file itself is not queued or cached for re-upload if the initial transfer fails due to network issues.