350-701 Endpoint Protection and Detection — Timed 10 Questions

Question 1

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

Accepted Answer

Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.. Option B is correct because Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Answer

Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.

Answer

Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.

Answer

Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.

Question 2

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

Accepted Answer

Cisco Secure Endpoint (AMP for Endpoints). Cisco Secure Endpoint (formerly AMP for Endpoints) is the correct answer because it provides cloud-based file reputation and analysis through its Advanced Malware Protection (AMP) cloud. This service uses global threat intelligence and machine learning to analyze file behavior, assign reputation scores, and block or quarantine malicious files on endpoints in real time.

Answer

Cisco Stealthwatch

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Firepower NGFW

Question 3

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Option A is correct because Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 4

A security analyst is investigating an alert from Cisco Secure Endpoint indicating that an endpoint has been infected with ransomware. The analyst wants to determine the initial infection vector. Which feature of Cisco Secure Endpoint should the analyst use to trace the chain of events leading to the infection?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides deep forensic visibility into endpoint activity, allowing the analyst to perform advanced queries across files, processes, registry keys, and network connections. This enables tracing the chain of events—such as a malicious email attachment, exploit, or drive-by download—that led to the ransomware infection, by correlating timestamps and process parent-child relationships.

Answer

TETRA traffic analysis

Answer

Windows Event Viewer integration

Answer

Device Flow Correlation

Question 5

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses exploit-specific signatures and behavioral monitoring to block common exploitation techniques (e.g., heap spray, ROP, SEH overwrite) without relying on known malware signatures, making it effective against zero-day exploits. Malware Analytics (C) is correct because it detonates suspicious files in a sandboxed environment to analyze behavior and detect previously unknown threats, providing protection against zero-day malware before signatures are available.

Answer

File Reputation

Answer

Application Control

Answer

Device Control

Question 6

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Accepted Answer

Application Control. Application Control (C) is correct because it allows administrators to define a whitelist of approved software, blocking all other executables from running on endpoints. Lockdown Mode (D) is correct because it enforces a strict policy where only pre-approved applications can execute, effectively preventing any unapproved software from running. Together, these features provide comprehensive control over executable files in a large enterprise environment.

Answer

Exploit Prevention

Answer

Malware Analytics

Answer

File Reputation

Question 7

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

Accepted Answer

The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.. Option B is correct because the log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.

Answer

The file was blocked at execution time by Exploit Prevention.

Answer

The cloud reputation determined the file was malicious and instructed the connector to quarantine.

Answer

The file was executed and then reverted by the retrospective engine.

Question 8

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Accepted Answer

The file will be allowed because local cache will store an unknown disposition.. When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Answer

The file will be held until the endpoint comes online and a cloud lookup completes.

Answer

The file will be quarantined due to the aggressive exploit prevention level.

Answer

The file will be blocked immediately by scan-on-write.

Question 9

A security analyst is investigating a compromised endpoint that is part of a botnet. The endpoint is running Cisco Secure Endpoint with TETRA. The analyst notices that the endpoint is communicating with a command-and-control (C2) server over HTTPS. Which TETRA feature would be most effective in detecting this traffic?

Accepted Answer

SSL/TLS decryption and inspection. TETRA (Telemetry and Threat Response Analytics) on Cisco Secure Endpoint can detect C2 traffic over HTTPS by performing SSL/TLS decryption and inspection. This allows the agent to examine encrypted payloads for malicious patterns, such as beaconing or command-and-control protocol artifacts, which would otherwise be hidden in the encrypted tunnel.

Answer

URL filtering against known malicious URL databases

Answer

File reputation and cloud lookup

Answer

Protocol analysis with deep packet inspection

Question 10

A company with 5,000 endpoints is using Cisco Secure Endpoint. The security team receives an alert that a specific file (SHA256: 8f4a...b2c) has been detected as malware on 10 endpoints. The file has been quarantined on those endpoints. The team wants to ensure that no other endpoints in the organization have this file. Which feature should be used to locate the file across all endpoints?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides a powerful, query-based search capability across all endpoints managed by Cisco Secure Endpoint. It allows the security team to search for specific file hashes (like SHA256: 8f4a...b2c) across the entire endpoint fleet, identifying any endpoint that has the file present, regardless of whether it has been quarantined or not. This is the only option that enables proactive, organization-wide file discovery beyond simple alert-based or policy-driven actions.

Answer

The Policy editor with file blacklist

Answer

TETRA traffic analysis

Answer

The AMP Dashboard with event filters