How does the Cisco Secure Firewall Threat Defense system check the AMP cloud for a file disposition?

It sends an SHA$-256$ hash of the file to the cloud that uniquely identifies the file, and the cloud returns a disposition for the hash value associated with the file.

It sends the entire file to the cloud, where the cloud runs the file in a sandbox environment to determine the file disposition, which is returned to the system.

It sends the filename to the cloud, which checks the filename against a list of known malware to determine the file disposition, which is returned to the system.

It sends the filename and SHA$-256$ has value to the cloud, and the cloud returns a disposition for both the filename and hash value.