350-701 Endpoint Protection and Detection Practice Test 5 — 15 Questions

Question 1

An organization is using Cisco Umbrella alongside Cisco AMP for Endpoints. A user reports that they cannot access a legitimate file-sharing website. However, the site is not categorized as malicious by Umbrella. What is the most likely reason for the block?

Accepted Answer

Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it. AMP's Intelligent Proxy (if using Umbrella's proxy) might block the file download if the file itself is classified as malicious by AMP even if the site is safe.

Answer

The website's domain is in a custom block list

Answer

The endpoint's firewall is blocking the connection

Answer

The user is behind a proxy that is not configured with Umbrella

Question 2

Which TWO of the following are capabilities of Cisco Orbital?

Accepted Answer

Running live queries across all endpoints. Cisco Orbital provides advanced endpoint querying and can run scripts on endpoints for investigation.

Answer

Real-time file reputation checking

Answer

Pre-execution sandboxing of unknown files

Answer

Automated endpoint isolation via ISE

Question 3

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). AMP can be deployed via MSI using Group Policy, SCCM, or manual installation; third-party RMM tools may also be used.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 4

Which TWO of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

MD5 hash of a malicious file. AMP can detect file hashes and IP connections as IOCs; behavioral rules are also used but not listed as typical IOCs.

Answer

The endpoint's last login time

Answer

The version of the operating system

Answer

The username of the logged-in user

Question 5

A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?

Accepted Answer

Verify that the endpoint can resolve the AMP cloud hostname using DNS.. Option B is correct because the AMP connector requires the correct cloud connectivity hostname (like *.amp.cisco.com) and port 443. If DNS resolution fails or the hostname is incorrect, the endpoint cannot communicate. Option A is wrong because the AMP connector does not use SNMP. Option C is wrong because a reboot is not typically required; the connector can retry automatically. Option D is wrong because the connector itself can resolve DNS; there is no separate proxy configuration inside the connector (but proxy can be configured via policy).

Answer

Configure the AMP connector to use a static IP address for the cloud.

Answer

Reboot the endpoint to force a policy download.

Answer

Verify that SNMP is enabled on the endpoint.

Question 6

An organization is deploying Cisco Secure Endpoint (AMP) for the first time in a Windows environment. The security team wants to ensure that any file executed from a USB drive is automatically scanned and blocked if malicious. Which policy feature should be enabled to achieve this?

Accepted Answer

Enable Removable Media Scan in the policy.. Option C is correct because 'Removable Media Scan' in the AMP policy specifically scans files on removable media. Option A is wrong because 'File Reputation' is global scanning for all file executions but not media-specific. Option B is wrong because 'Exploit Prevention' protects against exploits, not file scanning. Option D is wrong because 'Quarantine' is an action, not a feature that triggers scanning.

Answer

Enable File Reputation to check files against the cloud.

Answer

Enable Exploit Prevention to block malicious code execution.

Answer

Configure Quarantine actions for all file events.

Question 7

A multinational company plans to deploy Cisco AMP for Endpoints across 10,000 endpoints in geographically diverse offices. The security team is concerned about WAN bandwidth usage when endpoints communicate with the AMP cloud. Which design approach best minimizes cloud communication traffic while maintaining effective protection?

Accepted Answer

Deploy an AMP Private Cloud appliance on-site to handle local reputation queries.. Option D is correct because using a local private cloud appliance (like the AMP Private Cloud) keeps traffic within the LAN and reduces WAN usage. Option A is wrong because endpoint scanning frequency can be reduced, but that compromises protection. Option B is wrong because proxies add latency and do not reduce cloud queries. Option C is wrong because disabling certain features reduces protection.

Answer

Disable real-time file scanning and rely on scheduled scans only.

Answer

Reduce the frequency of file reputation lookups by setting a longer cache time.

Answer

Deploy a forward proxy to cache AMP cloud responses.

Question 8

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

Accepted Answer

Device Trajectory to review the event timeline.. Option B is correct because the Device Trajectory feature provides a time-ordered sequence of events, including parent-child process relationships. Option A is wrong because File Search only lists files, not process relationships. Option C is wrong because the Dashboard gives a high-level overview. Option D is wrong because the Group Policy shows policy settings, not events.

Answer

Group Policy to check applied policies.

Answer

Dashboard to view overall threat scores.

Answer

File Search to find files with unknown verdict.

Question 9

Which TWO of the following are valid detection methods used by Cisco AMP for Endpoints to identify malicious activity?

Accepted Answer

Exploit Prevention using vulnerability-based rules. Options A and C are correct. AMP uses File Reputation (cloud lookups based on SHA256) and Exploit Prevention (to block exploit techniques). Option B (Signature-based IPS) is not a typical AMP feature; AMP uses other methods. Option D (Anomaly-based behavioral detection) is not standard in AMP; it's more for IDS. Option E (Heuristic analysis) is not a primary AMP detection method.

Answer

Heuristic analysis of unknown files

Answer

Anomaly-based behavioral detection

Answer

Signature-based IPS scanning

Question 10

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Options B, C, and D are correct. Configuring whitelist exclusions (B) prevents legitimate applications from being flagged. Setting different policies for different groups (C) allows tailored rules. Using the 'Disposition' filter to block only malicious files (D) avoids blocking unknown benign files. Option A (Enable all exploit prevention rules) may cause false positives from legitimate applications. Option E (Disable file reputation) reduces protection.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries

Question 11

Which TWO are required to successfully deploy Cisco AMP for Endpoints in a Windows domain environment with Group Policy?

Accepted Answer

Install the AMP connector on each endpoint. Options A and D are correct. The AMP connector must be installed (A) and the policy must be assigned (D). Option B (install on a domain controller) is not required; the connector can be on any endpoint. Option C (configure firewall to block outbound HTTPS) would break connectivity. Option E (join all endpoints to the domain) is not strictly necessary; Group Policy can apply to non-domain machines via local policy.

Answer

Configure the firewall to block outbound HTTPS traffic

Answer

Install the AMP connector on a domain controller

Answer

Ensure all endpoints are joined to the domain

Question 12

A global enterprise with over 20,000 endpoints has been using Cisco AMP for Endpoints for two years. They recently migrated to a new SIEM and want to forward AMP events in near real-time. The security operations team notices that the SIEM is receiving duplicate events for the same file execution, causing alert fatigue. The AMP console shows that the 'Send to Syslog' action is enabled on two different policies, and both policies are applied to the same groups of endpoints. The team also uses the AMP APIs to pull data. The network engineer wants to eliminate duplicate events without losing any critical alerts. Which course of action should the engineer take?

Accepted Answer

Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.. Option C is correct because duplicate events are caused by multiple policies with the same syslog action. Consolidating policy assignments ensures that each endpoint receives only one policy with syslog forwarding. Option A (disable API) would stop API pulls but not duplicates from syslog. Option B (disable one policy) might remove the syslog action from one policy but could leave gaps if that policy has other important settings. Option D (increase detection interval) does not affect duplicates.

Answer

Disable the AMP API to stop duplicates from multiple data sources.

Answer

Increase the event detection interval to reduce the number of events generated.

Answer

Remove the 'Send to Syslog' action from one of the two policies.

Question 13

An organization is deploying Cisco Secure Endpoint (AMP) in a high-security environment where endpoints are air-gapped from the internet. The security team needs to maintain up-to-date threat intelligence without direct cloud access. They have a dedicated local server that can download feeds from the AMP cloud once and distribute to endpoints. The server runs the AMP Private Cloud software. However, after installation, endpoints are not receiving updates. The team verifies that the Private Cloud server can reach the AMP cloud via a managed proxy. The endpoints can communicate with the Private Cloud server on TCP 443. What is the most likely cause of the update failure?

Accepted Answer

The Private Cloud appliance has not been registered and licensed in the AMP console.. Option B is correct because the Private Cloud must be registered and licensed with Cisco to receive updates. Without registration, it cannot download threat intelligence. Option A (proxy misconfiguration) is possible but the team verified the proxy works. Option C (endpoint certificate issue) is less likely; endpoints authenticate via policy. Option D (Private Cloud out of disk space) would log errors, but not the primary cause if the server is newly set up.

Answer

The proxy is not properly configured to allow HTTPS from the Private Cloud to the AMP cloud.

Answer

The endpoints are using an incorrect certificate to authenticate to the Private Cloud.

Answer

The Private Cloud server's disk is full, preventing new update downloads.

Question 14

A financial company uses Cisco AMP for Endpoints to protect 500 Windows workstations. The security administrator notices that several endpoints in the accounting department are showing 'Out-of-Date' status for over a week. The administrator checks the AMP console and sees that the group policy for accounting has been modified to disable certain scanning features. The endpoints have Internet connectivity but are not updating their policy or receiving new definitions. The administrator suspects a misconfiguration. What should the administrator do first to resolve this issue?

Accepted Answer

Verify that the endpoints can communicate with the AMP cloud by checking the connector's connectivity status.. Option A is correct because the most common cause of 'Out-of-Date' endpoints is a communication issue. Checking the AMP connector's connection status (e.g., via the connector GUI) can reveal if the endpoint can reach the cloud. Option B (restart services) might temporarily fix but not identify root cause. Option C (reinstall connector) is drastic and should be last resort. Option D (increase polling interval) does not help if there is a connectivity obstacle.

Answer

Restart the AMP services on a few affected endpoints to force a policy update.

Answer

Increase the policy polling interval from 60 minutes to 30 minutes.

Answer

Reinstall the AMP connector on all affected endpoints.

Question 15

A security analyst is investigating a malware incident on an endpoint protected by Cisco AMP for Endpoints. The Device Trajectory shows that a file named 'invoice.exe' was detonated from a USB drive. The file's cloud verdict was 'Unknown' at the time of execution. The analyst sees that the file spawned multiple child processes that made outbound connections to a malicious IP. The AMP policy has 'Exploit Prevention' enabled but 'File Reputation' is set to 'Monitor' only. The analyst wants to prevent similar incidents in the future without blocking legitimate applications. Which action should the analyst recommend?

Accepted Answer

Change the File Reputation setting to 'Block' for files with 'Unknown' disposition.. Option B is correct because setting File Reputation to 'Block' would have prevented execution of 'Unknown' files like invoice.exe. However, this might block legitimate unknown files. Option A (blocking USB execution) is too restrictive. Option C (enabling more exploit prevention rules) would not have stopped this file because it was malware, not an exploit. Option D (adding file hash to blacklist) is reactive and not proactive.

Answer

Block all execution of applications from removable media via Group Policy.

Answer

Enable all Exploit Prevention rules, including those for script-based attacks.

Answer

Add the SHA256 hash of 'invoice.exe' to the global blacklist.