350-701 Endpoint Protection and Detection Practice Test 4 — 15 Questions

Question 1

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

Accepted Answer

The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.. Option C is correct because Cisco AMP for Endpoints uses a layered approach: cloud-based file reputation (Threat Grid) provides a score, but if the policy has Local Analysis enabled, the endpoint's local engine can override the cloud verdict. In this scenario, the local analysis determined the file was safe, so the file was allowed despite the high cloud score of 90. This explains the discrepancy between the Threat Grid score and the AMP connector's 'Allow' action.

Answer

The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.

Answer

The AMP policy has file reputation disabled, so all files are allowed.

Answer

The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.

Question 2

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Accepted Answer

Outbound HTTPS access to the AMP cloud backend servers.. Option C is correct because the AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Answer

A locally installed SQL database for event storage.

Answer

A proxy server configured in the connector settings.

Answer

An inbound firewall rule allowing connections from the AMP cloud.

Question 3

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Accepted Answer

Quarantine. Options B and D are correct. AMP policy rules can set actions such as 'Block' (B) and 'Quarantine' (D). Option A is incorrect because 'Delete' is not a direct action in AMP; quarantine effectively removes it. Option C is incorrect because 'Monitor' is a logging level, not an action. Option E is incorrect because 'Scan' is not an action; scanning is inherent.

Answer

Scan

Answer

Monitor

Answer

Delete

Question 4

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Options B, C, and E are correct. AMP can detect file hashes (B), IP addresses (C), and process executions (E) as IOCs. Option A is incorrect because social engineering is not a technical IOC detected by AMP. Option D is incorrect because physical intrusion is not detected by endpoint software.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 5

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

Accepted Answer

The connector is in a quarantine mode due to a loss of cloud connectivity.. Option B is correct. The 'Isolated' status means the connector is in a temporary state where it cannot communicate with the AMP cloud, but it may still function with cached rules. Option A is incorrect because a disabled network component would show 'Network Component: Disabled'. Option C is incorrect because the connector is still connected and working in a limited capacity. Option D is incorrect because 'Isolated' does not require manual intervention; it may auto-recover.

Answer

The connector is disconnected from the cloud and requires a reboot.

Answer

The connector is permanently blocked by a firewall and needs manual reconfiguration.

Answer

The network component is disabled, preventing network traffic monitoring.

Question 6

Refer to the exhibit. A file with SHA256 hash 'a1b2c3d4e5f6...' is detected on an endpoint. The threat grid returns a score of 90 for this file. What action is taken by AMP?

Accepted Answer

Block (because the custom detection rule has action 'block').. Option C is correct. The custom detection rule for that exact SHA256 overrides the file reputation rules, so the action is 'block'. Options A and B are incorrect because custom detections take precedence. Option D is incorrect because the file is matched by the custom detection.

Answer

Allow (because threat score 90 is not specifically matched in reputation).

Answer

Quarantine (because score 90 falls between 80 and 100).

Answer

No action (because the file is in the whitelist).

Question 7

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Accepted Answer

The proxy requires authentication, and the AMP connector has no credentials configured.. Option C is correct. The log shows a 'Proxy authentication failed' error with a 407 status, indicating missing or incorrect proxy credentials. Option A is incorrect because the initial timeout was overwritten by later errors. Option B is incorrect because the proxy is configured; it's the credentials that are missing. Option D is incorrect because the network connectivity was resolved; the proxy is rejecting the connection.

Answer

The AMP cloud servers are blocking the connector's IP address.

Answer

The proxy server address is incorrect in the connector configuration.

Answer

The connector has no network connectivity to the internet.

Question 8

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

Accepted Answer

Cisco Umbrella. Cisco Umbrella integrates with endpoint protection platforms to provide cloud-delivered security and block malicious domains, IPs, and file downloads anywhere the user goes.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco ISE

Question 9

An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?

Accepted Answer

Cisco ISE with pxGrid. Cisco AMP uses the Threat Response API and integrations with network access control to automate isolation. ISE integration allows AMP to trigger network quarantine.

Answer

Cisco Stealthwatch with NetFlow

Answer

Cisco Web Security Appliance

Answer

Cisco Firepower Next-Gen Firewall

Question 10

A security analyst observes that one endpoint is generating Alerts of type 'Trojan' in Cisco AMP, but other identical endpoints on the same software version show no issues. After verifying that the signature versions are consistent, what is the most likely cause of the discrepancy?

Accepted Answer

A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature. AMP uses behavioral analysis and machine learning; if one endpoint has a different application behavior or a legitimate application that behaves similarly to malware, it could cause a false positive. Other endpoints may not have that application.

Answer

The AMP connector is misconfigured and is generating false alerts

Answer

The endpoint's network traffic is being intercepted by a proxy causing AMP to misidentify it

Answer

The endpoint has an outdated operating system patch

Question 11

A company wants to ensure that only authorized applications can run on endpoints. Which feature of Cisco AMP for Endpoints should be used to create a whitelist of allowed applications?

Accepted Answer

Application Control. Application Control in AMP allows administrators to define policies that permit only approved applications to execute.

Answer

Exploit Prevention

Answer

Orbital Advanced Search

Answer

File Reputation

Question 12

A SOC analyst notices that after deploying Cisco AMP for Endpoints, some legitimate business software is being blocked by the Exploit Prevention engine. What is the recommended action to allow this software while maintaining maximum security?

Accepted Answer

Create an application exception in Exploit Prevention policy. The best practice is to create an exception for that specific application in the Exploit Prevention policy, rather than disabling the engine entirely or excluding the folder.

Answer

Disable Exploit Prevention entirely on affected endpoints

Answer

Add the software's executable hash to the file exclusion list

Answer

Set Exploit Prevention to 'Audit' mode

Question 13

During a threat hunt, you need to retrieve forensic data from a remote endpoint that is currently not communicating with the AMP cloud. Which Cisco tool enables you to perform an on-demand scan and collect telemetry from that endpoint even when it is offline?

Accepted Answer

Cisco Orbital. Cisco Orbital allows you to issue commands to endpoints for forensic data collection. If the endpoint is unreachable, you can schedule a task to execute when it reconnects.

Answer

Cisco Threat Response

Answer

Cisco Stealthwatch

Answer

Cisco AMP Console

Question 14

Which component of Cisco AMP for Endpoints is responsible for preventing the execution of known malware by checking files against a continuously updated cloud database before they run?

Accepted Answer

File Reputation. File Reputation uses cloud lookups to determine if a file is known to be malicious before it executes.

Answer

Exploit Prevention

Answer

Application Control

Answer

Orbital

Question 15

A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?

Accepted Answer

Enable 'Send alerts for malicious files' in the AMP policy. Cloud sandbox analysis provides verdicts; to get alerts you need to enable 'Send alerts on file reputation' and ensure that the cloud analysis is configured.

Answer

Configure Syslog forwarding for all events

Answer

Enable 'Exploit Prevention' in block mode

Answer

Set the connector to 'Analyze' mode