350-701 Practice Test 11 — 15 Questions

Question 1

An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?

Accepted Answer

Cisco ISE with pxGrid. Cisco AMP uses the Threat Response API and integrations with network access control to automate isolation. ISE integration allows AMP to trigger network quarantine.

Answer

Cisco Stealthwatch with NetFlow

Answer

Cisco Web Security Appliance

Answer

Cisco Firepower Next-Gen Firewall

Question 2

Which TWO of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

MD5 hash of a malicious file. AMP can detect file hashes and IP connections as IOCs; behavioral rules are also used but not listed as typical IOCs.

Answer

The endpoint's last login time

Answer

The version of the operating system

Answer

The username of the logged-in user

Question 3

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Accepted Answer

Quarantine. Options B and D are correct. AMP policy rules can set actions such as 'Block' (B) and 'Quarantine' (D). Option A is incorrect because 'Delete' is not a direct action in AMP; quarantine effectively removes it. Option C is incorrect because 'Monitor' is a logging level, not an action. Option E is incorrect because 'Scan' is not an action; scanning is inherent.

Answer

Scan

Answer

Monitor

Answer

Delete

Question 4

During a threat hunt, you need to retrieve forensic data from a remote endpoint that is currently not communicating with the AMP cloud. Which Cisco tool enables you to perform an on-demand scan and collect telemetry from that endpoint even when it is offline?

Accepted Answer

Cisco Orbital. Cisco Orbital allows you to issue commands to endpoints for forensic data collection. If the endpoint is unreachable, you can schedule a task to execute when it reconnects.

Answer

Cisco Threat Response

Answer

Cisco Stealthwatch

Answer

Cisco AMP Console

Question 5

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

Accepted Answer

The connector is in a quarantine mode due to a loss of cloud connectivity.. Option B is correct. The 'Isolated' status means the connector is in a temporary state where it cannot communicate with the AMP cloud, but it may still function with cached rules. Option A is incorrect because a disabled network component would show 'Network Component: Disabled'. Option C is incorrect because the connector is still connected and working in a limited capacity. Option D is incorrect because 'Isolated' does not require manual intervention; it may auto-recover.

Answer

The connector is disconnected from the cloud and requires a reboot.

Answer

The connector is permanently blocked by a firewall and needs manual reconfiguration.

Answer

The network component is disabled, preventing network traffic monitoring.

Question 6

A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?

Accepted Answer

Enable 'Send alerts for malicious files' in the AMP policy. Cloud sandbox analysis provides verdicts; to get alerts you need to enable 'Send alerts on file reputation' and ensure that the cloud analysis is configured.

Answer

Configure Syslog forwarding for all events

Answer

Enable 'Exploit Prevention' in block mode

Answer

Set the connector to 'Analyze' mode

Question 7

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Accepted Answer

The proxy requires authentication, and the AMP connector has no credentials configured.. Option C is correct. The log shows a 'Proxy authentication failed' error with a 407 status, indicating missing or incorrect proxy credentials. Option A is incorrect because the initial timeout was overwritten by later errors. Option B is incorrect because the proxy is configured; it's the credentials that are missing. Option D is incorrect because the network connectivity was resolved; the proxy is rejecting the connection.

Answer

The AMP cloud servers are blocking the connector's IP address.

Answer

The proxy server address is incorrect in the connector configuration.

Answer

The connector has no network connectivity to the internet.

Question 8

Which TWO of the following are capabilities of Cisco Orbital?

Accepted Answer

Running live queries across all endpoints. Cisco Orbital provides advanced endpoint querying and can run scripts on endpoints for investigation.

Answer

Real-time file reputation checking

Answer

Pre-execution sandboxing of unknown files

Answer

Automated endpoint isolation via ISE

Question 9

A security analyst observes that one endpoint is generating Alerts of type 'Trojan' in Cisco AMP, but other identical endpoints on the same software version show no issues. After verifying that the signature versions are consistent, what is the most likely cause of the discrepancy?

Accepted Answer

A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature. AMP uses behavioral analysis and machine learning; if one endpoint has a different application behavior or a legitimate application that behaves similarly to malware, it could cause a false positive. Other endpoints may not have that application.

Answer

The AMP connector is misconfigured and is generating false alerts

Answer

The endpoint's network traffic is being intercepted by a proxy causing AMP to misidentify it

Answer

The endpoint has an outdated operating system patch

Question 10

A company wants to ensure that only authorized applications can run on endpoints. Which feature of Cisco AMP for Endpoints should be used to create a whitelist of allowed applications?

Accepted Answer

Application Control. Application Control in AMP allows administrators to define policies that permit only approved applications to execute.

Answer

Exploit Prevention

Answer

Orbital Advanced Search

Answer

File Reputation

Question 11

A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?

Accepted Answer

Verify that the endpoint can resolve the AMP cloud hostname using DNS.. Option B is correct because the AMP connector requires the correct cloud connectivity hostname (like *.amp.cisco.com) and port 443. If DNS resolution fails or the hostname is incorrect, the endpoint cannot communicate. Option A is wrong because the AMP connector does not use SNMP. Option C is wrong because a reboot is not typically required; the connector can retry automatically. Option D is wrong because the connector itself can resolve DNS; there is no separate proxy configuration inside the connector (but proxy can be configured via policy).

Answer

Configure the AMP connector to use a static IP address for the cloud.

Answer

Reboot the endpoint to force a policy download.

Answer

Verify that SNMP is enabled on the endpoint.

Question 12

A SOC analyst notices that after deploying Cisco AMP for Endpoints, some legitimate business software is being blocked by the Exploit Prevention engine. What is the recommended action to allow this software while maintaining maximum security?

Accepted Answer

Create an application exception in Exploit Prevention policy. The best practice is to create an exception for that specific application in the Exploit Prevention policy, rather than disabling the engine entirely or excluding the folder.

Answer

Disable Exploit Prevention entirely on affected endpoints

Answer

Add the software's executable hash to the file exclusion list

Answer

Set Exploit Prevention to 'Audit' mode

Question 13

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). AMP can be deployed via MSI using Group Policy, SCCM, or manual installation; third-party RMM tools may also be used.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 14

An organization is deploying Cisco Secure Endpoint (AMP) for the first time in a Windows environment. The security team wants to ensure that any file executed from a USB drive is automatically scanned and blocked if malicious. Which policy feature should be enabled to achieve this?

Accepted Answer

Enable Removable Media Scan in the policy.. Option C is correct because 'Removable Media Scan' in the AMP policy specifically scans files on removable media. Option A is wrong because 'File Reputation' is global scanning for all file executions but not media-specific. Option B is wrong because 'Exploit Prevention' protects against exploits, not file scanning. Option D is wrong because 'Quarantine' is an action, not a feature that triggers scanning.

Answer

Enable File Reputation to check files against the cloud.

Answer

Enable Exploit Prevention to block malicious code execution.

Answer

Configure Quarantine actions for all file events.

Question 15

A multinational company plans to deploy Cisco AMP for Endpoints across 10,000 endpoints in geographically diverse offices. The security team is concerned about WAN bandwidth usage when endpoints communicate with the AMP cloud. Which design approach best minimizes cloud communication traffic while maintaining effective protection?

Accepted Answer

Deploy an AMP Private Cloud appliance on-site to handle local reputation queries.. Option D is correct because using a local private cloud appliance (like the AMP Private Cloud) keeps traffic within the LAN and reduces WAN usage. Option A is wrong because endpoint scanning frequency can be reduced, but that compromises protection. Option B is wrong because proxies add latency and do not reduce cloud queries. Option C is wrong because disabling certain features reduces protection.

Answer

Disable real-time file scanning and rely on scheduled scans only.

Answer

Reduce the frequency of file reputation lookups by setting a longer cache time.

Answer

Deploy a forward proxy to cache AMP cloud responses.