350-701 Endpoint Protection and Detection Practice Test 3 — 15 Questions

Question 1

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.. Cisco AMP for Endpoints integrates with Firepower Management Center (FMC) via the AMP cloud API. To enable this, the FMC must have the AMP integration enabled and be configured with the correct API credentials (Client ID and API Key) from the AMP cloud console. This allows the FMC to pull endpoint detection events directly from the AMP cloud, correlating them with network-based detections from the Firepower NGFW.

Answer

Configure the AMP connectors to send Syslog events to the FMC.

Answer

Deploy an on-premises AMP console to forward events to FMC.

Answer

Configure the Firepower NGFW to be the default gateway for the endpoints.

Question 2

An organization wants to enforce that specific sensitive files are never executed on endpoints. Which AMP for Endpoints feature is most appropriate?

Accepted Answer

Simple or advanced custom detections (Application Control). Simple or advanced custom detections (Application Control) allow administrators to create hash-based or path-based rules that explicitly block execution of specific files. This directly meets the requirement to prevent sensitive files from ever running on endpoints, as Application Control enforces allow/block policies at the file execution level, not just at the network or signature level.

Answer

Outbreak Control (file extension blocking)

Answer

Exclusion lists

Answer

Behavioral analysis and engine protection

Question 3

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

Accepted Answer

The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.. C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.

Answer

The cloud analysis result was delayed due to high traffic.

Answer

The local analysis engine was disabled, so the file was not analyzed locally.

Answer

The endpoint did not have connectivity to the AMP cloud at the time of execution.

Question 4

Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?

Accepted Answer

Deploy the AMP connector to all endpoints, including servers and desktops.. Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.

Answer

Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.

Answer

Set the default policy action to 'Block' for all file types to maximize security from day one.

Question 5

Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?

Accepted Answer

Fileless attack techniques (e.g., PowerShell injection). Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.

Answer

Malicious DNS queries

Answer

Phishing email headers

Answer

Anomalous network traffic patterns

Question 6

Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?

Accepted Answer

Block execution of the file. Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.

Answer

Allow the file after a scan

Answer

Encrypt the file to prevent harm

Answer

Delete the file

Question 7

Refer to the exhibit. The file invoice.pdf was determined to be malicious by the AMP cloud, yet the endpoint allowed it to execute. What is the most likely reason?

Accepted Answer

The AMP policy was configured to allow files with a certain confidence level or based on a custom rule.. The AMP for Endpoints connector sends a SHA-256 hash of the file to the AMP cloud for analysis. If the cloud determines the file is malicious but the endpoint still allows execution, the most likely reason is that the AMP policy has been configured with a custom rule or a confidence threshold that permits files at that specific malicious confidence level. This overrides the default block action for known malware.

Answer

The endpoint was not up to date with the latest AMP connector patches.

Answer

The file was not analyzed locally because local analysis was disabled.

Answer

The AMP connector lost connectivity after sending the file and fell back to a local allow policy.

Question 8

Refer to the exhibit. An engineer notices that a malicious file disguised as 'app.exe' in the FinanceApp folder (SHA-256 unknown to AMP) was blocked. However, another unknown executable in the same folder was also blocked, causing a false positive. What should the engineer change in the policy to allow only the legitimate 'app.exe' while still blocking unknown executables?

Accepted Answer

Change the file exclusion path to the exact full path of app.exe instead of a wildcard.. The current policy uses a wildcard file exclusion for the entire FinanceApp folder, which causes the AMP engine to skip scanning all files within that folder, including unknown executables. By changing the exclusion to the exact full path of the legitimate 'app.exe', only that specific file is excluded from scanning, while other unknown executables in the folder remain subject to the 'block' action for unknown files. This allows the known good file to execute without being blocked, while still blocking other unknown files that may be malicious.

Answer

Remove the file exclusion for the FinanceApp folder entirely.

Answer

Remove the process exclusion for app.exe.

Answer

Change the action for unknown files from 'block' to 'detect'.

Question 9

Refer to the exhibit. What happened to the file 'crack.exe'?

Accepted Answer

The file was blocked from executing.. The exhibit shows that Cisco AMP for Endpoints detected 'crack.exe' as malicious and applied the 'BLOCK' action, which prevents the file from executing on the endpoint. This is indicated by the 'BLOCK' disposition in the event details, meaning the file was blocked before it could run. Option B is correct because the file was blocked from executing based on the detection and policy configured in AMP.

Answer

The file was allowed because it was detected as malicious.

Answer

The file was detected but no action was taken.

Answer

The file was quarantined to a secure folder.

Question 10

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

Accepted Answer

The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.. The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Answer

The AMP license has expired.

Answer

Inbound firewall rules block incoming connections to the AMP connector.

Answer

The AMP connector service is stopped on the endpoint.

Question 11

A security engineer wants to implement file reputation analysis using Cisco AMP for Endpoints. The policy must block files that are known to be malicious in the cloud and quarantine unknown files for further analysis. Which AMP policy configuration achieves this?

Accepted Answer

Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.. Cisco AMP for Endpoints File Reputation rules allow granular control over file disposition. Setting 'Malware -> Block' ensures files with a known malicious disposition are prevented from executing, while 'Unknown -> Quarantine' sends files with an unknown disposition to the AMP cloud for retrospective analysis and containment. This directly matches the requirement to block known threats and quarantine unknowns for further analysis.

Answer

Create a policy with Application Control to block all executables from the internet.

Answer

Create a policy with File Reputation rules: Malware -> Block, Unknown -> Allow.

Answer

Create a policy with Custom Detection rules for specific SHA256 hashes only.

Question 12

An organization deploys AMP for Endpoints with the Orbital module to perform advanced endpoint telemetry. The team wants to create a query that retrieves all running processes with a network connection to an external IP address. Which Orbital query language syntax is correct?

Accepted Answer

SELECT * FROM all_processes WHERE remote_ip IN (SELECT ip FROM connections WHERE direction = 'OUT'). The Orbital query language uses SQL-like syntax, and the correct way to retrieve all running processes with a network connection to an external IP address is to join the `all_processes` table with the `connections` table, filtering for outbound connections (`direction = 'OUT'`) and checking that the `remote_ip` is not a private IP (though the query as written uses a subquery to get IPs from outbound connections). This directly matches the requirement of processes with external network connections.

Answer

SELECT * FROM all_processes WHERE ip = 'external'

Answer

SELECT * FROM all_processes WHERE listening = 'true'

Answer

SELECT * FROM processes WHERE network_connection = 'true'

Question 13

A company uses Cisco Umbrella to block malicious domains. An endpoint user reports that they cannot access a legitimate business website. The website resolves to a domain that is not on any block list. What is the most likely cause?

Accepted Answer

The domain is part of a content category that is blocked in the Umbrella policy.. Cisco Umbrella enforces security policies based on content categories, not just individual domains. Even if a domain is not explicitly blocked, it may belong to a content category (e.g., 'Newly Seen Domains', 'Pornography', 'Hacking') that has been set to 'Block' in the Umbrella policy. This is a common cause of legitimate sites being blocked, as Umbrella evaluates the domain against all applicable categories before allowing access.

Answer

The domain is listed in a custom Destination List with 'Block' action.

Answer

The Umbrella policy has Application Settings enabled for 'Web Browsing' with block action.

Answer

The Umbrella roaming client is using an invalid API token.

Question 14

An incident responder notices that an AMP connector on a critical server has stopped sending 'IP to Application' mapping events after a software update. Which step should be taken to restore this telemetry?

Accepted Answer

Enable the 'Network' component in the AMP connector settings and restart the service.. The AMP connector's 'IP to Application' mapping telemetry is provided by the Network component, which is separate from the File and Malware components. After a software update, this component may be disabled by default or reset. Enabling the Network component in the AMP connector settings and restarting the service restores the telemetry stream without requiring a full reinstall or policy reload.

Answer

Uninstall and reinstall the AMP connector with default settings.

Answer

Update the AMP policy on the connector to force a configuration reload.

Answer

Restart the AMP connector service on the server.

Question 15

A security architect is designing a solution to detect and block ransomware using Cisco AMP. The requirement is that when a file executes and attempts to encrypt files in a monitored directory, the event must be captured and the process terminated immediately. Which AMP feature set should be used?

Accepted Answer

Exploit Prevention with Behavioral Protection enabled.. Cisco AMP's Exploit Prevention with Behavioral Protection is designed to monitor file behavior in real time. When a file executes and attempts to encrypt files in a monitored directory, Behavioral Protection detects the anomalous activity (e.g., mass file modifications) and can immediately terminate the process, meeting the requirement to capture and block the ransomware event.

Answer

Application Control with a block list of known ransomware binaries.

Answer

Vulnerability Assessment with real-time patching.

Answer

Device Flow Correlation (DFC) with advanced malware analysis.