350-701 Endpoint Protection and Detection Practice Test 2 — 15 Questions

Question 1

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Option B is correct because Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 2

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Accepted Answer

Device Trajectory to visualize the timeline of events on an endpoint. Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

Answer

Real-time blocking of malicious processes at the endpoint

Answer

Automatic deployment of software patches to endpoints

Question 3

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.

Question 4

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Question 5

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Question 6

Match each security technology to its primary function.

Question 7

Match each threat type to its definition.

Question 8

A security engineer notices that several endpoints in the HR department have been infected with ransomware despite having Cisco AMP for Endpoints deployed. The AMP policy is set to 'Detect' for all file types. What is the most likely reason the ransomware was not blocked?

Accepted Answer

The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.. Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.

Answer

The endpoints had process exclusions that allowed the ransomware process.

Answer

The AMP cloud was unreachable during the infection attempt.

Answer

The file was too large for cloud analysis and AMP timed out.

Question 9

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Option D is correct because starting with 'Audit' mode allows observation without disruption. Option A is wrong because blocking all unknown files may cause false positives. Option B is wrong because disabling the firewall weakens security. Option C is wrong because disabling file analysis reduces detection capability.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 10

An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?

Accepted Answer

The endpoint's AMP connector has local analysis disabled, preventing hash matching.. When AMP for Endpoints fails to detect a file that is known to be malicious (based on its hash) and other endpoints have already detected it, the most likely cause is that local analysis (also known as local scanning or local hash matching) is disabled on the failing endpoint. AMP for Endpoints uses a combination of cloud-based lookups and local analysis. If local analysis is disabled, the endpoint cannot perform hash-based detection against its local cache or signature database, and it must rely entirely on cloud connectivity. If the cloud lookup is delayed or the endpoint is offline, detection fails. Option B directly addresses this scenario.

Answer

The AMP connector is not configured with a proxy when needed.

Answer

The AMP signature database on that endpoint is outdated.

Answer

The AMP policy is set to 'Block' instead of 'Detect'.

Question 11

A security team is designing an endpoint protection strategy for a mix of Windows and macOS endpoints. They want to use Cisco AMP for Endpoints with centralized management. Which deployment approach minimizes administrative overhead?

Accepted Answer

Use the AMP cloud console to manage a single policy that applies to both platforms with os-specific exclusions.. Option D is correct because Cisco AMP for Endpoints offers a cloud-based console that provides centralized management for both Windows and macOS endpoints from a single pane of glass. This eliminates the need for on-premises infrastructure or separate management tools, and a single policy can be applied across platforms with OS-specific exclusions to handle differences in file paths and processes, thereby minimizing administrative overhead.

Answer

Deploy an on-premises AMP Console for each operating system.

Answer

Install a Windows Server as a management point and deploy connectors via SCCM.

Answer

Use group policies to define different policies for Windows and macOS.

Question 12

During a ransomware attack, an endpoint protected by AMP for Endpoints successfully blocked the ransomware file. Which AMP policy action was likely applied?

Accepted Answer

Block. When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

Answer

Allow

Answer

Quarantine

Answer

Detect

Question 13

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

Accepted Answer

Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.. Option D is correct because adding a file hash to the custom detection list as an exception prevents future alerts. Option A is wrong because disabling detection for that file type is too broad. Option B is wrong because changing policy to 'Audit' reduces protection. Option C is wrong because only the cloud can update dispositions, but custom exceptions are used for false positives.

Answer

Submit the file to Cisco TALOS for reanalysis.

Answer

Disable AMP detection for that file type globally.

Answer

Change the AMP policy from 'Detect' to 'Audit' for the endpoint.

Question 14

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

Accepted Answer

Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.. Option A is correct because the AMP connector must be registered with the AMP cloud, and the FMC must be configured to pull events via API. Option B is wrong because the firewall does not need to be the default gateway. Option C is wrong because Syslog is not the primary method; API integration is used. Option D is wrong because the AMP cloud account is already used; the issue is registration.

Answer

Configure the AMP connectors to send Syslog events to the FMC.

Answer

Deploy an on-premises AMP console to forward events to FMC.

Answer

Configure the Firepower NGFW to be the default gateway for the endpoints.

Question 15

An organization wants to enforce that specific sensitive files are never executed on endpoints. Which AMP for Endpoints feature is most appropriate?

Accepted Answer

Simple or advanced custom detections (Application Control). Option C is correct because Application Control (file blocking) allows blocking specific files by hash, path, or name. Option A is wrong because Exclusions allow files to run. Option B is wrong because Outbreak Control blocks file extensions, not specific files. Option D is wrong because Behavioral Analysis detects anomalies, not enforce static blocks.

Answer

Outbreak Control (file extension blocking)

Answer

Exclusion lists

Answer

Behavioral analysis and engine protection