350-701 Endpoint Protection and Detection Practice Test 2 — 15 Questions

Question 1

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.. The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.

Answer

The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.

Answer

The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.

Answer

The file was determined to be malicious by the cloud after the first detection.

Question 2

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

Accepted Answer

Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.. The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Answer

Restart the Cisco AMP for Endpoints connector service on the affected endpoints.

Answer

Change the update policy interval from 4 hours to 1 hour to force more frequent checks.

Answer

Check if the firewall is blocking the signature update port 443 for those specific endpoints.

Question 3

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 4

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Accepted Answer

Device Trajectory to visualize the timeline of events on an endpoint. Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

Answer

Real-time blocking of malicious processes at the endpoint

Answer

Automatic deployment of software patches to endpoints

Question 5

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.

Question 6

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Accepted Answer

Step 1: Configure IKE policy (Phase 1), Step 2: Set pre-shared key, Step 3: Define interesting traffic via ACL, Step 4: Configure crypto map (binding Phase 2), Step 5: Apply crypto map to interface. IKE policy defines Phase 1 parameters, then pre-shared key is set, interesting traffic is defined via ACL, crypto map binds Phase 2 parameters, and it is applied to the interface.

Answer

Step 1: Define interesting traffic via ACL, Step 2: Configure IKE policy, Step 3: Set pre-shared key, Step 4: Configure crypto map, Step 5: Apply to interface

Answer

Step 1: Configure IKE policy, Step 2: Set pre-shared key, Step 3: Configure crypto map, Step 4: Define interesting traffic ACL, Step 5: Apply to interface

Answer

Step 1: Configure IKE policy, Step 2: Set pre-shared key, Step 3: Define interesting traffic ACL, Step 4: Apply crypto map to interface, Step 5: Configure crypto map

Question 7

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Accepted Answer

Enable AnyConnect image, then Define IP pool, then Group policy, then Tunnel group, then Apply to interface. First enable AnyConnect image, then define IP pool, group policy, tunnel group, and apply to interface.

Answer

Apply to interface, then Enable AnyConnect image, then Define IP pool, then Group policy, then Tunnel group

Answer

Enable AnyConnect image, then Group policy, then Define IP pool, then Tunnel group, then Apply to interface

Answer

Enable AnyConnect image, then Define IP pool, then Tunnel group, then Group policy, then Apply to interface

Question 8

Match each security technology to its primary function.

Accepted Answer

Firewall: Filters traffic based on stateful inspection and access control lists.. Firewall filters traffic based on rules; IDS/IPS monitors for threats; VPN provides secure tunnels; NAC enforces compliance. Common mistakes include confusing IDS/IPS with firewall and NAC with VPN.

Answer

Firewall: Monitors network traffic for malicious activity and can block or alert.

Answer

VPN: Enforces endpoint compliance and access policies.

Question 9

Match each threat type to its definition.

Accepted Answer

DDoS: Overwhelming a system with traffic from multiple sources. Correct matches: DDoS = traffic flood, Phishing = fraudulent emails, Malware = malicious software, Ransomware = encryption extortion. Common confusions: associating DDoS with encryption or phishing with traffic overload.

Answer

DDoS: Malware that encrypts data and demands payment

Answer

Phishing: Overwhelming a system with traffic from multiple sources

Question 10

A security engineer notices that several endpoints in the HR department have been infected with ransomware despite having Cisco AMP for Endpoints deployed. The AMP policy is set to 'Detect' for all file types. What is the most likely reason the ransomware was not blocked?

Accepted Answer

The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.. Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.

Answer

The endpoints had process exclusions that allowed the ransomware process.

Answer

The AMP cloud was unreachable during the infection attempt.

Answer

The file was too large for cloud analysis and AMP timed out.

Question 11

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 12

An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?

Accepted Answer

The endpoint's AMP connector has local analysis disabled, preventing hash matching.. When AMP for Endpoints fails to detect a file that is known to be malicious (based on its hash) and other endpoints have already detected it, the most likely cause is that local analysis (also known as local scanning or local hash matching) is disabled on the failing endpoint. AMP for Endpoints uses a combination of cloud-based lookups and local analysis. If local analysis is disabled, the endpoint cannot perform hash-based detection against its local cache or signature database, and it must rely entirely on cloud connectivity. If the cloud lookup is delayed or the endpoint is offline, detection fails. Option B directly addresses this scenario.

Answer

The AMP connector is not configured with a proxy when needed.

Answer

The AMP signature database on that endpoint is outdated.

Answer

The AMP policy is set to 'Block' instead of 'Detect'.

Question 13

A security team is designing an endpoint protection strategy for a mix of Windows and macOS endpoints. They want to use Cisco AMP for Endpoints with centralized management. Which deployment approach minimizes administrative overhead?

Accepted Answer

Use the AMP cloud console to manage a single policy that applies to both platforms with os-specific exclusions.. Cisco AMP for Endpoints offers a cloud-based console that provides centralized management for both Windows and macOS endpoints from a single pane of glass. This eliminates the need for on-premises infrastructure or separate management tools, and a single policy can be applied across platforms with OS-specific exclusions to handle differences in file paths and processes, thereby minimizing administrative overhead.

Answer

Deploy an on-premises AMP Console for each operating system.

Answer

Install a Windows Server as a management point and deploy connectors via SCCM.

Answer

Use group policies to define different policies for Windows and macOS.

Question 14

During a ransomware attack, an endpoint protected by AMP for Endpoints successfully blocked the ransomware file. Which AMP policy action was likely applied?

Accepted Answer

Block. When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

Answer

Allow

Answer

Quarantine

Answer

Detect

Question 15

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

Accepted Answer

Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.. The recommended action to prevent a known false positive from being flagged again is to add the file's SHA-256 hash to the custom detection list with an 'Allow' or 'Uncategorized' disposition. This overrides the local or cloud-based verdict for that specific file, ensuring AMP for Endpoints treats it as clean without affecting global detection policies.

Answer

Submit the file to Cisco TALOS for reanalysis.

Answer

Disable AMP detection for that file type globally.

Answer

Change the AMP policy from 'Detect' to 'Audit' for the endpoint.