350-701 Endpoint Protection and Detection — 30 Questions

Question 1

A multinational company plans to deploy Cisco AMP for Endpoints across 10,000 endpoints in geographically diverse offices. The security team is concerned about WAN bandwidth usage when endpoints communicate with the AMP cloud. Which design approach best minimizes cloud communication traffic while maintaining effective protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy an AMP Private Cloud appliance on-site to handle local reputation queries.. Deploying an AMP Private Cloud appliance on-site allows endpoints to perform local reputation queries, keeping traffic within the LAN and minimizing WAN bandwidth usage. Option A is wrong because disabling real-time file scanning and relying solely on scheduled scans leaves endpoints vulnerable between scans, significantly reducing protection. Option B is wrong because reducing the frequency of file reputation lookups by setting a longer cache time can delay detection of new threats, compromising security. Option C is wrong because a forward proxy caches AMP cloud responses but still requires WAN queries for cache misses and introduces additional latency; it does not reduce cloud communication traffic as effectively as a local private cloud.

Answer

Disable real-time file scanning and rely on scheduled scans only.

Answer

Reduce the frequency of file reputation lookups by setting a longer cache time.

Answer

Deploy a forward proxy to cache AMP cloud responses.

Question 2

Based on the exhibit, what is the most likely reason that traffic matching the AMP_block access-list is not being blocked?

Accepted Answer

The access-list is not referenced in any policy-map or class-map. For an access-list to affect traffic on a Cisco Firepower Threat Defense (FTD) device, it must be referenced within a policy-map (e.g., using the `class-map` and `policy-map` configuration). The AMP_block access-list is defined but not referenced in any policy-map, so it is not applied to traffic. Option A is incorrect because the remark command syntax does not affect blocking; remarks are just comments. Option B is incorrect because the problem is not that the policy-map lacks a pass or block action; rather, the access-list itself is not referenced at all in any policy-map. Option D is incorrect because on FTD, access-lists are not applied directly to interfaces; they are used within policy-maps which are then applied to interfaces. Therefore, the lack of interface application is not the root cause.

Answer

The remark command is incorrectly formatted

Answer

The policy-map does not include a pass or block action for the access-list

Answer

The access-list is not applied to an interface

Question 3

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

Accepted Answer

Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.. Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Answer

Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.

Answer

Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.

Answer

Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.

Question 4

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

Accepted Answer

Cisco Secure Endpoint (AMP for Endpoints). Cisco Secure Endpoint (formerly AMP for Endpoints) is the correct answer because it provides cloud-based file reputation and analysis through its Advanced Malware Protection (AMP) cloud. This service uses global threat intelligence and machine learning to analyze file behavior, assign reputation scores, and block or quarantine malicious files on endpoints in real time.

Answer

Cisco Stealthwatch

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Firepower NGFW

Question 5

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 6

A security analyst is investigating an alert from Cisco Secure Endpoint indicating that an endpoint has been infected with ransomware. The analyst wants to determine the initial infection vector. Which feature of Cisco Secure Endpoint should the analyst use to trace the chain of events leading to the infection?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides deep forensic visibility into endpoint activity, allowing the analyst to perform advanced queries across files, processes, registry keys, and network connections. This enables tracing the chain of events—such as a malicious email attachment, exploit, or drive-by download—that led to the ransomware infection, by correlating timestamps and process parent-child relationships.

Answer

TETRA traffic analysis

Answer

Windows Event Viewer integration

Answer

Device Flow Correlation

Question 7

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses exploit-specific signatures and behavioral monitoring to block common exploitation techniques (e.g., heap spray, ROP, SEH overwrite) without relying on known malware signatures, making it effective against zero-day exploits. Malware Analytics (C) is correct because it detonates suspicious files in a sandboxed environment to analyze behavior and detect previously unknown threats, providing protection against zero-day malware before signatures are available.

Answer

File Reputation

Answer

Application Control

Answer

Device Control

Question 8

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Accepted Answer

Application Control. Application Control (C) is correct because it allows administrators to define a whitelist of approved software, blocking all other executables from running on endpoints. Lockdown Mode (D) is correct because it enforces a strict policy where only pre-approved applications can execute, effectively preventing any unapproved software from running. Together, these features provide comprehensive control over executable files in a large enterprise environment.

Answer

Exploit Prevention

Answer

Malware Analytics

Answer

File Reputation

Question 9

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

Accepted Answer

The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.. The log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.

Answer

The file was blocked at execution time by Exploit Prevention.

Answer

The cloud reputation determined the file was malicious and instructed the connector to quarantine.

Answer

The file was executed and then reverted by the retrospective engine.

Question 10

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Accepted Answer

The file will be allowed because local cache will store an unknown disposition.. When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Answer

The file will be held until the endpoint comes online and a cloud lookup completes.

Answer

The file will be quarantined due to the aggressive exploit prevention level.

Answer

The file will be blocked immediately by scan-on-write.

Question 11

A security analyst is investigating a compromised endpoint that is part of a botnet. The endpoint is running Cisco Secure Endpoint with TETRA. The analyst notices that the endpoint is communicating with a command-and-control (C2) server over HTTPS. Which TETRA feature would be most effective in detecting this traffic?

Accepted Answer

SSL/TLS decryption and inspection. TETRA (Telemetry and Threat Response Analytics) on Cisco Secure Endpoint can detect C2 traffic over HTTPS by performing SSL/TLS decryption and inspection. This allows the agent to examine encrypted payloads for malicious patterns, such as beaconing or command-and-control protocol artifacts, which would otherwise be hidden in the encrypted tunnel.

Answer

URL filtering against known malicious URL databases

Answer

File reputation and cloud lookup

Answer

Protocol analysis with deep packet inspection

Question 12

A company with 5,000 endpoints is using Cisco Secure Endpoint. The security team receives an alert that a specific file (SHA256: 8f4a...b2c) has been detected as malware on 10 endpoints. The file has been quarantined on those endpoints. The team wants to ensure that no other endpoints in the organization have this file. Which feature should be used to locate the file across all endpoints?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides a powerful, query-based search capability across all endpoints managed by Cisco Secure Endpoint. It allows the security team to search for specific file hashes (like SHA256: 8f4a...b2c) across the entire endpoint fleet, identifying any endpoint that has the file present, regardless of whether it has been quarantined or not. This is the only option that enables proactive, organization-wide file discovery beyond simple alert-based or policy-driven actions.

Answer

The Policy editor with file blacklist

Answer

TETRA traffic analysis

Answer

The AMP Dashboard with event filters

Question 13

A security engineer is troubleshooting an issue where Cisco AMP for Endpoints is not detecting a known malware sample on a Windows endpoint. The endpoint is running Windows 10 with the latest AMP connector installed and is connected to the corporate network. The malware sample was downloaded from a trusted source for testing. Which configuration is most likely causing the lack of detection?

Accepted Answer

The connector is configured to operate in offline mode.. When Cisco AMP for Endpoints is in offline mode, the connector cannot communicate with the cloud-based threat intelligence and reputation servers. This prevents it from performing file reputation lookups and retrieving the latest malware signatures, so even known malware samples will not be detected. The connector relies on cloud lookups for real-time detection of new or known threats, and offline mode disables this critical function.

Answer

The file reputation scanning is disabled.

Answer

Custom detections are not configured for the malware.

Answer

Real-time scanning is disabled for the download directory.

Question 14

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Accepted Answer

Exploit prevention with ransomware rollback. Cisco's endpoint protection includes a behavioral analysis engine that monitors for ransomware-like activities (e.g., mass file encryption, rapid file modifications). Upon detection, the feature automatically triggers a rollback, restoring affected files to their pre-encryption state using Volume Shadow Copy Service (VSS) snapshots or similar mechanisms, effectively reversing the ransomware's changes.

Answer

File reputation scanning

Answer

Device flow telemetry

Answer

Application blocking via policy

Question 15

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. The AMP for Endpoints connector policy must be configured to submit files to the on-premises Threat Grid appliance. This directs the endpoint connector to send suspicious files to the local Threat Grid for dynamic analysis instead of the public cloud. Option C is correct because the Threat Grid appliance must be registered in the AMP cloud as a private analysis provider, which creates a secure tunnel (using TLS) between the AMP cloud and the on-premises appliance, enabling file submission and result retrieval.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 16

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Accepted Answer

The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.. The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.

Answer

The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.

Answer

The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.

Answer

The file was determined to be malicious by the cloud after the first detection.

Question 17

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

Accepted Answer

Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.. The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Answer

Restart the Cisco AMP for Endpoints connector service on the affected endpoints.

Answer

Change the update policy interval from 4 hours to 1 hour to force more frequent checks.

Answer

Check if the firewall is blocking the signature update port 443 for those specific endpoints.

Question 18

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 19

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Accepted Answer

Device Trajectory to visualize the timeline of events on an endpoint. Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

Answer

Real-time blocking of malicious processes at the endpoint

Answer

Automatic deployment of software patches to endpoints

Question 20

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.