350-701 Endpoint Protection and Detection Practice Test 5 — 15 Questions

Question 1

Which component of Cisco AMP for Endpoints is responsible for preventing the execution of known malware by checking files against a continuously updated cloud database before they run?

Accepted Answer

File Reputation. File Reputation is the correct answer because it is the Cisco AMP for Endpoints component that queries a continuously updated cloud database (the AMP Threat Grid) to check the reputation of a file before it executes. If the file is known malware, execution is blocked immediately, preventing the threat from running. This pre-execution check relies on the file's SHA-256 hash and cloud-based reputation scoring.

Answer

Exploit Prevention

Answer

Application Control

Answer

Orbital

Question 2

A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?

Accepted Answer

Enable 'Send alerts for malicious files' in the AMP policy. The 'Send alerts for malicious files' setting in the AMP for Endpoints policy directly controls whether the connector sends a real-time alert to the management console when a file is determined to be malicious by the cloud sandbox (e.g., Threat Grid). This ensures immediate notification without relying on periodic polling or batch reporting.

Answer

Configure Syslog forwarding for all events

Answer

Enable 'Exploit Prevention' in block mode

Answer

Set the connector to 'Analyze' mode

Question 3

An organization is using Cisco Umbrella alongside Cisco AMP for Endpoints. A user reports that they cannot access a legitimate file-sharing website. However, the site is not categorized as malicious by Umbrella. What is the most likely reason for the block?

Accepted Answer

Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it. Cisco AMP for Endpoints includes an Intelligent Proxy feature that can inspect and block file downloads based on real-time threat intelligence, even if the website itself is not categorized as malicious by Cisco Umbrella. In this scenario, the user can access the site but the file download is blocked, which aligns with AMP's Intelligent Proxy intercepting the download and determining it to be potentially malicious.

Answer

The website's domain is in a custom block list

Answer

The endpoint's firewall is blocking the connection

Answer

The user is behind a proxy that is not configured with Umbrella

Question 4

Which TWO of the following are capabilities of Cisco Orbital?

Accepted Answer

Running live queries across all endpoints. Cisco Orbital is a cloud-based endpoint query and response tool that uses the osquery framework to allow security teams to run live SQL-like queries across all endpoints in real time. It also supports scheduled forensic data collection tasks, enabling continuous monitoring and historical analysis of endpoint state without requiring persistent agents or heavy infrastructure.

Answer

Real-time file reputation checking

Answer

Pre-execution sandboxing of unknown files

Answer

Automated endpoint isolation via ISE

Question 5

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 6

Which TWO of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

MD5 hash of a malicious file. Cisco AMP for Endpoints uses file reputation analysis based on cryptographic hashes, including MD5, to identify known malicious files. When an endpoint attempts to execute or download a file, AMP computes its MD5 hash and compares it against a cloud-based threat intelligence database; a match indicates a known malware sample and is a clear indicator of compromise.

Answer

The endpoint's last login time

Answer

The version of the operating system

Answer

The username of the logged-in user

Question 7

A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?

Accepted Answer

Verify that the endpoint can resolve the AMP cloud hostname using DNS.. The AMP connector must resolve the AMP cloud hostname (e.g., `amp.cisco.com`) via DNS to establish the HTTPS connection. Even if outbound HTTPS is allowed, a DNS resolution failure would prevent the endpoint from reaching the cloud, causing the 'Out-of-Date' status. Verifying DNS ensures the endpoint can translate the hostname to an IP address, which is a prerequisite for policy updates.

Answer

Configure the AMP connector to use a static IP address for the cloud.

Answer

Reboot the endpoint to force a policy download.

Answer

Verify that SNMP is enabled on the endpoint.

Question 8

An organization is deploying Cisco Secure Endpoint (AMP) for the first time in a Windows environment. The security team wants to ensure that any file executed from a USB drive is automatically scanned and blocked if malicious. Which policy feature should be enabled to achieve this?

Accepted Answer

Enable Removable Media Scan in the policy.. Cisco Secure Endpoint (AMP) includes a dedicated 'Removable Media Scan' policy feature that automatically scans files executed from USB drives and other removable media. When enabled, this feature triggers a scan of any file launched from a removable device, and if the file is determined to be malicious based on local or cloud reputation, it can be blocked or quarantined before execution completes.

Answer

Enable File Reputation to check files against the cloud.

Answer

Enable Exploit Prevention to block malicious code execution.

Answer

Configure Quarantine actions for all file events.

Question 9

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

Accepted Answer

Device Trajectory to review the event timeline.. Device Trajectory provides a chronological timeline of events on the endpoint, allowing the responder to trace file executions back to their parent processes. By reviewing the trajectory, the responder can identify which files with unknown verdicts were spawned by a known malicious parent process, directly answering the investigation need.

Answer

Group Policy to check applied policies.

Answer

Dashboard to view overall threat scores.

Answer

File Search to find files with unknown verdict.

Question 10

Which TWO of the following are valid detection methods used by Cisco AMP for Endpoints to identify malicious activity?

Accepted Answer

Exploit Prevention using vulnerability-based rules. Cisco AMP for Endpoints includes Exploit Prevention, which uses vulnerability-based rules to detect and block exploit attempts targeting specific software vulnerabilities. These rules are tailored to the exploit technique rather than the malware file itself, allowing protection against zero-day exploits that leverage known vulnerabilities.

Answer

Heuristic analysis of unknown files

Answer

Anomaly-based behavioral detection

Answer

Signature-based IPS scanning

Question 11

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Configuring custom whitelist exclusions for trusted applications prevents Cisco AMP for Endpoints from flagging legitimate software as malicious, which directly reduces false positives. This is done by adding file hashes, paths, or certificate signers to the exclusion list, ensuring that known safe executables are not subjected to further analysis or blocked.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries

Question 12

Which TWO are required to successfully deploy Cisco AMP for Endpoints in a Windows domain environment with Group Policy?

Accepted Answer

Install the AMP connector on each endpoint. The AMP for Endpoints connector is the agent software that must be installed on each endpoint to provide malware detection, file trajectory, and retrospective security analysis. Without the connector, the endpoint cannot communicate with the AMP cloud or enforce any security policies, making deployment non-functional.

Answer

Configure the firewall to block outbound HTTPS traffic

Answer

Install the AMP connector on a domain controller

Answer

Ensure all endpoints are joined to the domain

Question 13

A global enterprise with over 20,000 endpoints has been using Cisco AMP for Endpoints for two years. They recently migrated to a new SIEM and want to forward AMP events in near real-time. The security operations team notices that the SIEM is receiving duplicate events for the same file execution, causing alert fatigue. The AMP console shows that the 'Send to Syslog' action is enabled on two different policies, and both policies are applied to the same groups of endpoints. The team also uses the AMP APIs to pull data. The network engineer wants to eliminate duplicate events without losing any critical alerts. Which course of action should the engineer take?

Accepted Answer

Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.. Duplicate events occur because the same set of endpoints is covered by two different policies both with the 'Send to Syslog' action enabled. By reviewing the group hierarchy and ensuring each endpoint is assigned to a single policy that includes the syslog action, you eliminate duplicates while still forwarding all events. Option A (disable API) does not affect syslog duplicates; the API is a separate data source. Option B (increase detection interval) would not deduplicate events; it only changes the rate of detection. Option C (remove syslog action from one policy) might still cause duplicates if the other policy still applies to the same endpoints, and it could also affect other security settings in that policy. The proper approach is to maintain a clean policy assignment hierarchy.

Answer

Disable the AMP API to stop duplicates from multiple data sources.

Answer

Increase the event detection interval to reduce the number of events generated.

Answer

Remove the 'Send to Syslog' action from one of the two policies.

Question 14

An organization is deploying Cisco Secure Endpoint (AMP) in a high-security environment where endpoints are air-gapped from the internet. The security team needs to maintain up-to-date threat intelligence without direct cloud access. They have a dedicated local server that can download feeds from the AMP cloud once and distribute to endpoints. The server runs the AMP Private Cloud software. However, after installation, endpoints are not receiving updates. The team verifies that the Private Cloud server can reach the AMP cloud via a managed proxy. The endpoints can communicate with the Private Cloud server on TCP 443. What is the most likely cause of the update failure?

Accepted Answer

The Private Cloud appliance has not been registered and licensed in the AMP console.. The Private Cloud must be registered and licensed with Cisco to receive updates. Without registration, it cannot download threat intelligence. Option A (proxy misconfiguration) is possible but the team verified the proxy works. Option C (endpoint certificate issue) is less likely; endpoints authenticate via policy. Option D (Private Cloud out of disk space) would log errors, but not the primary cause if the server is newly set up.

Answer

The proxy is not properly configured to allow HTTPS from the Private Cloud to the AMP cloud.

Answer

The endpoints are using an incorrect certificate to authenticate to the Private Cloud.

Answer

The Private Cloud server's disk is full, preventing new update downloads.

Question 15

A financial company uses Cisco AMP for Endpoints to protect 500 Windows workstations. The security administrator notices that several endpoints in the accounting department are showing 'Out-of-Date' status for over a week. The administrator checks the AMP console and sees that the group policy for accounting has been modified to disable certain scanning features. The endpoints have Internet connectivity but are not updating their policy or receiving new definitions. The administrator suspects a misconfiguration. What should the administrator do first to resolve this issue?

Accepted Answer

Verify that the endpoints can communicate with the AMP cloud by checking the connector's connectivity status.. The most common cause of 'Out-of-Date' endpoints is a communication issue. Checking the AMP connector's connection status (e.g., via the connector GUI) can reveal if the endpoint can reach the cloud. Option A (restarting services) might temporarily fix but does not identify the root cause. Option C (increasing polling interval) does not help if there is a connectivity obstacle. Option D (reinstalling the connector) is drastic and should be a last resort.

Answer

Restart the AMP services on a few affected endpoints to force a policy update.

Answer

Increase the policy polling interval from 60 minutes to 30 minutes.

Answer

Reinstall the AMP connector on all affected endpoints.