350-701 Endpoint Protection and Detection Practice Test 3 — 15 Questions

Question 1

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

Accepted Answer

The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.. Option B is correct because if the policy action for 'Unknown' is set to 'Audit' or 'Allow', the file runs while cloud analysis completes. Option A is wrong because local analysis is used for known files, not unknowns. Option C is wrong because the file would have been blocked eventually if policy required it. Option D is wrong because connectivity issues would prevent cloud analysis altogether.

Answer

The cloud analysis result was delayed due to high traffic.

Answer

The local analysis engine was disabled, so the file was not analyzed locally.

Answer

The endpoint did not have connectivity to the AMP cloud at the time of execution.

Question 2

Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?

Accepted Answer

Deploy the AMP connector to all endpoints, including servers and desktops.. Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.

Answer

Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.

Answer

Set the default policy action to 'Block' for all file types to maximize security from day one.

Question 3

Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?

Accepted Answer

Fileless attack techniques (e.g., PowerShell injection). Options B and E are correct. AMP detects malware through file hashes and behavioral analysis (fileless attacks). Option A is wrong because DNS queries are not directly detected by AMP endpoint. Option C is wrong because network traffic is analyzed by firewalls, not endpoint AMP. Option D is wrong because email headers are not endpoint indicators.

Answer

Malicious DNS queries

Answer

Phishing email headers

Answer

Anomalous network traffic patterns

Question 4

Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?

Accepted Answer

Block execution of the file. Options B and C are correct. AMP can block execution and quarantine the file. Option A is wrong because deleting is not a standard action. Option D is wrong because encrypting would harm the system. Option E is wrong because allowing is opposite of protection.

Answer

Allow the file after a scan

Answer

Encrypt the file to prevent harm

Answer

Delete the file

Question 5

Refer to the exhibit. The file invoice.pdf was determined to be malicious by the AMP cloud, yet the endpoint allowed it to execute. What is the most likely reason?

Accepted Answer

The AMP policy was configured to allow files with a certain confidence level or based on a custom rule.. Option D is correct because the policy rule 'Allow on low confidence' overrides the cloud verdict. Option A is wrong because the patch level is not indicated as an issue. Option B is wrong because the file was analyzed locally, and a verdict was returned. Option C is wrong because the action was explicit, not a fallback

Answer

The endpoint was not up to date with the latest AMP connector patches.

Answer

The file was not analyzed locally because local analysis was disabled.

Answer

The AMP connector lost connectivity after sending the file and fell back to a local allow policy.

Question 6

Refer to the exhibit. An engineer notices that a malicious file disguised as 'app.exe' in the FinanceApp folder (SHA-256 unknown to AMP) was blocked. However, another unknown executable in the same folder was also blocked, causing a false positive. What should the engineer change in the policy to allow only the legitimate 'app.exe' while still blocking unknown executables?

Accepted Answer

Change the file exclusion path to the exact full path of app.exe instead of a wildcard.. Option B is correct because a file exclusion by path prevents scanning of all files in that path, including the specific app.exe, but would also allow other files there. Option A is wrong because it removes the process exclusion, which may be needed for legitimate app. Option C is wrong because changing action to 'detect' would allow all unknowns. Option D is wrong because removing the file exclusion completely would block app.exe too.

Answer

Remove the file exclusion for the FinanceApp folder entirely.

Answer

Remove the process exclusion for app.exe.

Answer

Change the action for unknown files from 'block' to 'detect'.

Question 7

Refer to the exhibit. What happened to the file 'crack.exe'?

Accepted Answer

The file was blocked from executing.. Option C is correct because the log says 'Blocked by policy'. Option A is wrong because it was not allowed. Option B is wrong because it was not quarantined (no mention of quarantine). Option D is wrong because it was not just detected; action was taken.

Answer

The file was allowed because it was detected as malicious.

Answer

The file was detected but no action was taken.

Answer

The file was quarantined to a secure folder.

Question 8

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

Accepted Answer

The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.. The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Answer

The AMP license has expired.

Answer

Inbound firewall rules block incoming connections to the AMP connector.

Answer

The AMP connector service is stopped on the endpoint.

Question 9

A security engineer wants to implement file reputation analysis using Cisco AMP for Endpoints. The policy must block files that are known to be malicious in the cloud and quarantine unknown files for further analysis. Which AMP policy configuration achieves this?

Accepted Answer

Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.. Option A is correct because 'File reputation' with action 'Block' for Malware and 'Quarantine' for Unknown meets the requirement. Option B is incorrect because 'Allow' for Unknown does not quarantine. Option C is incorrect because 'Custom detection' does not directly address global reputation. Option D is incorrect because 'Application control' is for allow/block lists, not reputation.

Answer

Create a policy with Application Control to block all executables from the internet.

Answer

Create a policy with File Reputation rules: Malware -> Block, Unknown -> Allow.

Answer

Create a policy with Custom Detection rules for specific SHA256 hashes only.

Question 10

An organization deploys AMP for Endpoints with the Orbital module to perform advanced endpoint telemetry. The team wants to create a query that retrieves all running processes with a network connection to an external IP address. Which Orbital query language syntax is correct?

Accepted Answer

SELECT * FROM all_processes WHERE remote_ip IN (SELECT ip FROM connections WHERE direction = 'OUT'). Option D is correct because the Orbital 'all_processes' table with 'IN' filter for network connections is the standard approach. Option A is incorrect because 'processes' is not a valid table; it's 'all_processes'. Option B is incorrect because 'listening' is for listening ports, not outgoing connections. Option C is incorrect because the 'where' clause incorrectly uses 'ip' without qualifying.

Answer

SELECT * FROM all_processes WHERE ip = 'external'

Answer

SELECT * FROM all_processes WHERE listening = 'true'

Answer

SELECT * FROM processes WHERE network_connection = 'true'

Question 11

A company uses Cisco Umbrella to block malicious domains. An endpoint user reports that they cannot access a legitimate business website. The website resolves to a domain that is not on any block list. What is the most likely cause?

Accepted Answer

The domain is part of a content category that is blocked in the Umbrella policy.. Option B is correct because 'Content Categories' in Umbrella can inadvertently block categories like 'Business' or 'Information Technology' if misconfigured. Option A is incorrect because an invalid token would block all internet access. Option C is incorrect because 'Application Settings' control application-level filtering, not URL access. Option D is incorrect because 'Destination Lists' are specific domains, not categories.

Answer

The domain is listed in a custom Destination List with 'Block' action.

Answer

The Umbrella policy has Application Settings enabled for 'Web Browsing' with block action.

Answer

The Umbrella roaming client is using an invalid API token.

Question 12

An incident responder notices that an AMP connector on a critical server has stopped sending 'IP to Application' mapping events after a software update. Which step should be taken to restore this telemetry?

Accepted Answer

Enable the 'Network' component in the AMP connector settings and restart the service.. Option C is correct because the 'IP to Application' mapping feature requires the 'Network' component to be enabled in the AMP connector configuration post-update. Option A is incorrect because restarting the service does not re-enable the component. Option B is incorrect because a policy update would not enable a disabled component. Option D is incorrect because reinstalling would be unnecessarily disruptive.

Answer

Uninstall and reinstall the AMP connector with default settings.

Answer

Update the AMP policy on the connector to force a configuration reload.

Answer

Restart the AMP connector service on the server.

Question 13

A security architect is designing a solution to detect and block ransomware using Cisco AMP. The requirement is that when a file executes and attempts to encrypt files in a monitored directory, the event must be captured and the process terminated immediately. Which AMP feature set should be used?

Accepted Answer

Exploit Prevention with Behavioral Protection enabled.. Option A is correct because AMP's 'Exploit Prevention' combined with 'Behavioral Protection' specifically monitors for ransomware-like behavior and can terminate processes. Option B is incorrect because 'Device Flow Correlation' is for network traffic analysis. Option C is incorrect because 'Application Control' only allows/denies execution, not behavioral analysis. Option D is incorrect because 'Vulnerability Assessment' checks for CVEs, not runtime behavior.

Answer

Application Control with a block list of known ransomware binaries.

Answer

Vulnerability Assessment with real-time patching.

Answer

Device Flow Correlation (DFC) with advanced malware analysis.

Question 14

An organization wants to deploy AMP for Endpoints in an offline environment where endpoints cannot connect to the internet. Which deployment option is appropriate?

Accepted Answer

Install a Cisco AMP Private Cloud appliance within the local network and point connectors to it.. Option D is correct because Cisco AMP supports a 'Private Cloud' appliance, which can be deployed in an isolated network. Option A is incorrect because AMP connectors require cloud connectivity for full functionality. Option B is incorrect because 'Standalone' mode does not exist for AMP connectors. Option C is incorrect because proxy mode does not enable offline operation without internet.

Answer

Deploy the AMP connectors with a local proxy caching all AMP communications.

Answer

Configure the AMP connectors in 'Standalone' mode to operate without cloud communication.

Answer

Use Cisco ESA as an intermediary to proxy AMP requests from endpoints.

Question 15

A security analyst sees multiple AMP events for 'Trojan.Generic.37283212' on several endpoints. After updating the AMP signatures, the detection still occurs. What is the best next step to reduce false positives?

Accepted Answer

Add the file SHA256 hash to the Custom Whitelist in the AMP policy.. Option B is correct because adding the file hash to the 'Custom Whitelist' in the AMP policy will prevent future detection of that specific variant. Option A is incorrect because updating signatures does not address a false positive if the detection is correct. Option C is incorrect because disabling the signature entirely would remove protection. Option D is incorrect because reinstalling the connector is not targeted.

Answer

Wait for the next signature update that might remove the detection.

Answer

Disable the signature for Trojan.Generic in the AMP policy.

Answer

Reinstall the AMP connector on the affected endpoints.