350-701 Endpoint Protection and Detection Practice Test 4 — 15 Questions

Question 1

An organization wants to deploy AMP for Endpoints in an offline environment where endpoints cannot connect to the internet. Which deployment option is appropriate?

Accepted Answer

Install a Cisco AMP Private Cloud appliance within the local network and point connectors to it.. Cisco AMP for Endpoints offers a Private Cloud appliance that can be deployed on-premises in an offline environment. This appliance replicates all cloud-based threat intelligence and analysis locally, allowing endpoints to communicate with it via the AMP connector without requiring internet access. The Private Cloud appliance handles all file disposition, retrospective alerts, and policy updates within the local network.

Answer

Deploy the AMP connectors with a local proxy caching all AMP communications.

Answer

Configure the AMP connectors in 'Standalone' mode to operate without cloud communication.

Answer

Use Cisco ESA as an intermediary to proxy AMP requests from endpoints.

Question 2

A security analyst sees multiple AMP events for 'Trojan.Generic.37283212' on several endpoints. After updating the AMP signatures, the detection still occurs. What is the best next step to reduce false positives?

Accepted Answer

Add the file SHA256 hash to the Custom Whitelist in the AMP policy.. Adding the file SHA256 hash to the Custom Whitelist in the AMP policy explicitly tells the AMP cloud to ignore that specific file, preventing false positives without disabling broader protections. Since the detection persists after signature updates, the file is likely a legitimate application that is being incorrectly flagged by the generic heuristic signature 'Trojan.Generic.37283212'. Whitelisting the exact hash ensures that only this file is exempted, maintaining security for other threats.

Answer

Wait for the next signature update that might remove the detection.

Answer

Disable the signature for Trojan.Generic in the AMP policy.

Answer

Reinstall the AMP connector on the affected endpoints.

Question 3

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

Accepted Answer

The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.. Cisco AMP for Endpoints uses a layered approach: cloud-based file reputation (Threat Grid) provides a score, but if the policy has Local Analysis enabled, the endpoint's local engine can override the cloud verdict. In this scenario, the local analysis determined the file was safe, so the file was allowed despite the high cloud score of 90. This explains the discrepancy between the Threat Grid score and the AMP connector's 'Allow' action.

Answer

The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.

Answer

The AMP policy has file reputation disabled, so all files are allowed.

Answer

The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.

Question 4

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Accepted Answer

Outbound HTTPS access to the AMP cloud backend servers.. The AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Answer

A locally installed SQL database for event storage.

Answer

A proxy server configured in the connector settings.

Answer

An inbound firewall rule allowing connections from the AMP cloud.

Question 5

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Accepted Answer

Quarantine. In an AMP policy rule, the valid action types that can be assigned to a file are 'Quarantine' and 'Block'. Quarantine isolates the file to prevent execution or spread, while Block denies access to the file entirely. Both are core enforcement actions in Cisco AMP for Endpoints, used to stop threats based on file reputation or analysis.

Answer

Scan

Answer

Monitor

Answer

Delete

Question 6

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 7

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

Accepted Answer

The connector is in a quarantine mode due to a loss of cloud connectivity.. In Cisco AMP (Advanced Malware Protection) for Endpoints, the 'Isolated: Yes' status indicates that the connector has entered quarantine mode because it has lost connectivity to the AMP cloud. This is a security feature that prevents the endpoint from communicating with other hosts on the network while still allowing outbound traffic to the cloud for reconnection attempts. The connector remains functional but isolated to contain potential threats until cloud connectivity is restored.

Answer

The connector is disconnected from the cloud and requires a reboot.

Answer

The connector is permanently blocked by a firewall and needs manual reconfiguration.

Answer

The network component is disabled, preventing network traffic monitoring.

Question 8

Refer to the exhibit. A file with SHA256 hash 'a1b2c3d4e5f6...' is detected on an endpoint. The threat grid returns a score of 90 for this file. What action is taken by AMP?

Accepted Answer

Block (because the custom detection rule has action 'block').. The exhibit shows a custom detection rule configured with an action of 'block'. In Cisco AMP, custom detection rules take precedence over reputation scores or threat grid analysis. When a file matches a custom SHA256 hash rule, AMP applies the configured action (block) regardless of the threat score, which in this case is 90.

Answer

Allow (because threat score 90 is not specifically matched in reputation).

Answer

Quarantine (because score 90 falls between 80 and 100).

Answer

No action (because the file is in the whitelist).

Question 9

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Accepted Answer

The proxy requires authentication, and the AMP connector has no credentials configured.. The AMP connector is configured to use a proxy server, but the proxy requires authentication. Without credentials configured in the connector, the proxy will reject the HTTP CONNECT request (RFC 7231), preventing the connector from establishing the TLS tunnel to the AMP cloud. This is a common scenario when an organization uses an authenticated forward proxy, and the connector's proxy settings lack the username/password fields.

Answer

The AMP cloud servers are blocking the connector's IP address.

Answer

The proxy server address is incorrect in the connector configuration.

Answer

The connector has no network connectivity to the internet.

Question 10

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the correct answer because it provides cloud-delivered threat intelligence that can be integrated with existing endpoint protection platforms (EPPs) to block malicious file downloads regardless of the user's location. Umbrella uses DNS-layer security and cloud-based threat feeds to enforce policies on endpoints even when they are off the corporate network, making it ideal for location-agnostic protection.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco ISE

Question 11

An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?

Accepted Answer

Cisco ISE with pxGrid. Cisco ISE with pxGrid (Platform Exchange Grid) enables automated policy-based responses by allowing Cisco AMP for Endpoints to share threat intelligence with ISE. When AMP detects a high-severity malware, it triggers a pxGrid event that instructs ISE to dynamically quarantine the host by applying a security group access control list (SGACL) or a CoA (Change of Authorization) to block network access. This integration is specifically designed for context sharing and automated remediation across Cisco security products.

Answer

Cisco Stealthwatch with NetFlow

Answer

Cisco Web Security Appliance

Answer

Cisco Firepower Next-Gen Firewall

Question 12

A security analyst observes that one endpoint is generating Alerts of type 'Trojan' in Cisco AMP, but other identical endpoints on the same software version show no issues. After verifying that the signature versions are consistent, what is the most likely cause of the discrepancy?

Accepted Answer

A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature. In Cisco AMP, a single endpoint generating 'Trojan' alerts while identical peers remain clean, with consistent signature versions, strongly indicates a false positive caused by a legitimate application exhibiting behavior that matches a Trojan signature. AMP uses behavioral analysis and signature-based detection; if a benign application performs actions (e.g., file writes, registry modifications, or network connections) that resemble known malware patterns, it can trigger an alert. Since other endpoints with the same software and signatures are unaffected, the issue is localized to that specific endpoint's unique application or configuration, not a global misconfiguration or signature issue.

Answer

The AMP connector is misconfigured and is generating false alerts

Answer

The endpoint's network traffic is being intercepted by a proxy causing AMP to misidentify it

Answer

The endpoint has an outdated operating system patch

Question 13

A company wants to ensure that only authorized applications can run on endpoints. Which feature of Cisco AMP for Endpoints should be used to create a whitelist of allowed applications?

Accepted Answer

Application Control. Application Control in Cisco AMP for Endpoints allows administrators to define a whitelist of approved applications by specifying SHA-256 hashes, file paths, or publisher certificates. This feature enforces a 'deny-by-default' policy, blocking any executable not explicitly allowed, which directly meets the requirement to ensure only authorized applications can run on endpoints.

Answer

Exploit Prevention

Answer

Orbital Advanced Search

Answer

File Reputation

Question 14

A SOC analyst notices that after deploying Cisco AMP for Endpoints, some legitimate business software is being blocked by the Exploit Prevention engine. What is the recommended action to allow this software while maintaining maximum security?

Accepted Answer

Create an application exception in Exploit Prevention policy. Cisco AMP for Endpoints' Exploit Prevention engine uses behavioral analysis to block suspicious activities, and legitimate software may trigger these heuristics. Creating an application exception in the Exploit Prevention policy allows the specific software to run without disabling the entire engine, preserving protection against other exploits. This targeted exception maintains maximum security by only exempting the known legitimate application from exploit detection rules.

Answer

Disable Exploit Prevention entirely on affected endpoints

Answer

Add the software's executable hash to the file exclusion list

Answer

Set Exploit Prevention to 'Audit' mode

Question 15

During a threat hunt, you need to retrieve forensic data from a remote endpoint that is currently not communicating with the AMP cloud. Which Cisco tool enables you to perform an on-demand scan and collect telemetry from that endpoint even when it is offline?

Accepted Answer

Cisco Orbital. Cisco Orbital is the correct answer because it is a remote endpoint investigation and response tool that can execute live queries, on-demand scans, and collect forensic telemetry from endpoints even when they are not currently communicating with the AMP cloud. It uses a lightweight agent that caches queries locally and returns results once connectivity is restored, enabling offline data collection.

Answer

Cisco Threat Response

Answer

Cisco Stealthwatch

Answer

Cisco AMP Console