Which two statements are correct about Juniper ATP Cloud malware analysis?

The correct answers are A and C. Juniper ATP Cloud uses a malware-analysis pipeline. When a file is submitted, the first step is a cache lookup based on the file hash. Juniper explains that if the file has already been analyzed, the stored verdict is returned to the SRX Series Firewall and there is no need to re-analyze the file. That directly supports C and eliminates B, because analysis does not continue when a cached verdict is found.

If the cache lookup does not return a verdict, the remaining ATP Cloud analysis techniques are used. Juniper describes the pipeline model in which each analysis technique creates a verdict number, and those verdicts are combined into a final verdict score from 0 to 10. That final threat score is what the SRX compares against ATP Cloud policy settings to permit or block the session.

Option D is wrong because ATP Cloud does not simply return the first score generated by any one feature. The expected behavior is cumulative/final scoring across the remaining analysis pipeline. Reference topics: Juniper ATP Cloud, malware analysis pipeline, cache lookup, verdict number, threat score, SRX enforcement.