350-701 Endpoint Protection and Detection — 50 Questions

Question 1

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 2

A security analyst is investigating an alert from Cisco Secure Endpoint indicating that an endpoint has been infected with ransomware. The analyst wants to determine the initial infection vector. Which feature of Cisco Secure Endpoint should the analyst use to trace the chain of events leading to the infection?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides deep forensic visibility into endpoint activity, allowing the analyst to perform advanced queries across files, processes, registry keys, and network connections. This enables tracing the chain of events—such as a malicious email attachment, exploit, or drive-by download—that led to the ransomware infection, by correlating timestamps and process parent-child relationships.

Answer

TETRA traffic analysis

Answer

Windows Event Viewer integration

Answer

Device Flow Correlation

Question 3

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Accepted Answer

Application Control. Application Control (C) is correct because it lets the administrator define an allowlist of approved applications so that only those executables are permitted to run, while all other executables are blocked. Lockdown Mode (D) is correct because it enforces a strict allowlist-based execution policy on the endpoint, preventing unauthorized or unapproved executables from running. Exploit Prevention (A) is not correct because it focuses on blocking exploitation techniques against vulnerable processes, not on controlling which applications are allowed to execute. Malware Analytics (B) is not correct because it provides file analysis and threat intelligence, not execution allowlisting. File Reputation (E) is not correct because it uses cloud-based reputation to classify files as malicious or clean, but it does not by itself restrict execution to only approved software.

Answer

Exploit Prevention

Answer

Malware Analytics

Answer

File Reputation

Question 4

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

Accepted Answer

The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.. The log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.

Answer

The file was blocked at execution time by Exploit Prevention.

Answer

The cloud reputation determined the file was malicious and instructed the connector to quarantine.

Answer

The file was executed and then reverted by the retrospective engine.

Question 5

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Accepted Answer

The file will be allowed because local cache will store an unknown disposition.. When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Answer

The file will be held until the endpoint comes online and a cloud lookup completes.

Answer

The file will be quarantined due to the aggressive exploit prevention level.

Answer

The file will be blocked immediately by scan-on-write.

Question 6

A security analyst is investigating a compromised endpoint that is part of a botnet. The endpoint is running Cisco Secure Endpoint with TETRA. The analyst notices that the endpoint is communicating with a command-and-control (C2) server over HTTPS. Which TETRA feature would be most effective in detecting this traffic?

Accepted Answer

SSL/TLS decryption and inspection. TETRA (Telemetry and Threat Response Analytics) on Cisco Secure Endpoint can detect C2 traffic over HTTPS by performing SSL/TLS decryption and inspection. This allows the agent to examine encrypted payloads for malicious patterns, such as beaconing or command-and-control protocol artifacts, which would otherwise be hidden in the encrypted tunnel.

Answer

URL filtering against known malicious URL databases

Answer

File reputation and cloud lookup

Answer

Protocol analysis with deep packet inspection

Question 7

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The connector is configured to operate in offline mode.. When Cisco AMP for Endpoints is in offline mode, the connector cannot communicate with the cloud-based threat intelligence and reputation servers. This prevents it from performing file reputation lookups and retrieving the latest malware signatures, so even known malware samples will not be detected. The connector relies on cloud lookups for real-time detection of new or known threats, and offline mode disables this critical function.

Answer

The file reputation scanning is disabled.

Answer

Custom detections are not configured for the malware.

Answer

Real-time scanning is disabled for the download directory.

Question 8

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Accepted Answer

Exploit prevention with ransomware rollback. Cisco's endpoint protection includes a behavioral analysis engine that monitors for ransomware-like activities (e.g., mass file encryption, rapid file modifications). Upon detection, the feature automatically triggers a rollback, restoring affected files to their pre-encryption state using Volume Shadow Copy Service (VSS) snapshots or similar mechanisms, effectively reversing the ransomware's changes.

Answer

File reputation scanning

Answer

Device flow telemetry

Answer

Application blocking via policy

Question 9

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Accepted Answer

The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.. The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.

Answer

The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.

Answer

The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.

Answer

The file was determined to be malicious by the cloud after the first detection.

Question 10

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

Accepted Answer

Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.. The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Answer

Restart the Cisco AMP for Endpoints connector service on the affected endpoints.

Answer

Change the update policy interval from 4 hours to 1 hour to force more frequent checks.

Answer

Check if the firewall is blocking the signature update port 443 for those specific endpoints.

Question 11

A security engineer notices that several endpoints in the HR department have been infected with ransomware despite having Cisco AMP for Endpoints deployed. The AMP policy is set to 'Detect' for all file types. What is the most likely reason the ransomware was not blocked?

Accepted Answer

The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.. Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.

Answer

The endpoints had process exclusions that allowed the ransomware process.

Answer

The AMP cloud was unreachable during the infection attempt.

Answer

The file was too large for cloud analysis and AMP timed out.

Question 12

An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?

Accepted Answer

The endpoint's AMP connector has local analysis disabled, preventing hash matching.. When AMP for Endpoints fails to detect a file that is known to be malicious (based on its hash) and other endpoints have already detected it, the most likely cause is that local analysis (also known as local scanning or local hash matching) is disabled on the failing endpoint. AMP for Endpoints uses a combination of cloud-based lookups and local analysis. If local analysis is disabled, the endpoint cannot perform hash-based detection against its local cache or signature database, and it must rely entirely on cloud connectivity. If the cloud lookup is delayed or the endpoint is offline, detection fails. Option B directly addresses this scenario.

Answer

The AMP connector is not configured with a proxy when needed.

Answer

The AMP signature database on that endpoint is outdated.

Answer

The AMP policy is set to 'Block' instead of 'Detect'.

Question 13

An organization wants to enforce that specific sensitive files are never executed on endpoints. Which AMP for Endpoints feature is most appropriate?

Accepted Answer

Simple or advanced custom detections (Application Control). Simple or advanced custom detections (Application Control) allow administrators to create hash-based or path-based rules that explicitly block execution of specific files. This directly meets the requirement to prevent sensitive files from ever running on endpoints, as Application Control enforces allow/block policies at the file execution level, not just at the network or signature level.

Answer

Outbreak Control (file extension blocking)

Answer

Exclusion lists

Answer

Behavioral analysis and engine protection

Question 14

Refer to the exhibit. An engineer notices that a malicious file disguised as 'app.exe' in the FinanceApp folder (SHA-256 unknown to AMP) was blocked. However, another unknown executable in the same folder was also blocked, causing a false positive. What should the engineer change in the policy to allow only the legitimate 'app.exe' while still blocking unknown executables?

Accepted Answer

Change the file exclusion path to the exact full path of app.exe instead of a wildcard.. The current policy uses a wildcard file exclusion for the entire FinanceApp folder, which causes the AMP engine to skip scanning all files within that folder, including unknown executables. By changing the exclusion to the exact full path of the legitimate 'app.exe', only that specific file is excluded from scanning, while other unknown executables in the folder remain subject to the 'block' action for unknown files. This allows the known good file to execute without being blocked, while still blocking other unknown files that may be malicious.

Answer

Remove the file exclusion for the FinanceApp folder entirely.

Answer

Remove the process exclusion for app.exe.

Answer

Change the action for unknown files from 'block' to 'detect'.

Question 15

An organization deploys AMP for Endpoints with the Orbital module to perform advanced endpoint telemetry. The team wants to create a query that retrieves all running processes with a network connection to an external IP address. Which Orbital query language syntax is correct?

Accepted Answer

SELECT * FROM all_processes WHERE remote_ip IN (SELECT ip FROM connections WHERE direction = 'OUT'). The Orbital query language uses SQL-like syntax, and the correct way to retrieve all running processes with a network connection to an external IP address is to join the `all_processes` table with the `connections` table, filtering for outbound connections (`direction = 'OUT'`) and checking that the `remote_ip` is not a private IP (though the query as written uses a subquery to get IPs from outbound connections). This directly matches the requirement of processes with external network connections.

Answer

SELECT * FROM all_processes WHERE ip = 'external'

Answer

SELECT * FROM all_processes WHERE listening = 'true'

Answer

SELECT * FROM processes WHERE network_connection = 'true'

Question 16

An incident responder notices that an AMP connector on a critical server has stopped sending 'IP to Application' mapping events after a software update. Which step should be taken to restore this telemetry?

Accepted Answer

Enable the 'Network' component in the AMP connector settings and restart the service.. The AMP connector's 'IP to Application' mapping telemetry is provided by the Network component, which is separate from the File and Malware components. After a software update, this component may be disabled by default or reset. Enabling the Network component in the AMP connector settings and restarting the service restores the telemetry stream without requiring a full reinstall or policy reload.

Answer

Uninstall and reinstall the AMP connector with default settings.

Answer

Update the AMP policy on the connector to force a configuration reload.

Answer

Restart the AMP connector service on the server.

Question 17

A security architect is designing a solution to detect and block ransomware using Cisco AMP. The requirement is that when a file executes and attempts to encrypt files in a monitored directory, the event must be captured and the process terminated immediately. Which AMP feature set should be used?

Accepted Answer

Exploit Prevention with Behavioral Protection enabled.. Cisco AMP's Exploit Prevention with Behavioral Protection is designed to monitor file behavior in real time. When a file executes and attempts to encrypt files in a monitored directory, Behavioral Protection detects the anomalous activity (e.g., mass file modifications) and can immediately terminate the process, meeting the requirement to capture and block the ransomware event.

Answer

Application Control with a block list of known ransomware binaries.

Answer

Vulnerability Assessment with real-time patching.

Answer

Device Flow Correlation (DFC) with advanced malware analysis.

Question 18

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

Accepted Answer

The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.. Cisco AMP for Endpoints uses a layered approach: cloud-based file reputation (Threat Grid) provides a score, but if the policy has Local Analysis enabled, the endpoint's local engine can override the cloud verdict. In this scenario, the local analysis determined the file was safe, so the file was allowed despite the high cloud score of 90. This explains the discrepancy between the Threat Grid score and the AMP connector's 'Allow' action.

Answer

The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.

Answer

The AMP policy has file reputation disabled, so all files are allowed.

Answer

The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.

Question 19

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Accepted Answer

Quarantine. In Cisco AMP for Endpoints, a policy rule applied to a file can be assigned the action types Quarantine (C) and Block (D). Quarantine (C) is valid because AMP can move a detected malicious file into a quarantined state, isolating it so it cannot execute or be accessed by the user. Block (D) is valid because AMP can prevent the file from executing or being written/run on the endpoint, enforcing a deny action. The remaining options are not valid AMP file action types: Scan (A) is an operation/analysis function rather than a policy action, Monitor (B) is not an assignable file action in an AMP policy rule, and Delete (E) is not an AMP policy action type for files.

Answer

Scan

Answer

Monitor

Answer

Delete

Question 20

Refer to the exhibit. A file with SHA256 hash 'a1b2c3d4e5f6...' is detected on an endpoint. The threat grid returns a score of 90 for this file. What action is taken by AMP?

Accepted Answer

Block (because the custom detection rule has action 'block').. The exhibit shows a custom detection rule configured with an action of 'block'. In Cisco AMP, custom detection rules take precedence over reputation scores or threat grid analysis. When a file matches a custom SHA256 hash rule, AMP applies the configured action (block) regardless of the threat score, which in this case is 90.

Answer

Allow (because threat score 90 is not specifically matched in reputation).

Answer

Quarantine (because score 90 falls between 80 and 100).

Answer

No action (because the file is in the whitelist).