350-701 Endpoint Protection and Detection Practice Question
A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?
⚠ Common exam trap
Cisco often tests the distinction between 'Analyze' mode (which enables file submission to the cloud) and the separate alerting toggle, leading candidates to mistakenly think that enabling analysis automatically generates alerts for malicious verdicts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Send alerts for malicious files' in the AMP policy
The 'Send alerts for malicious files' setting in the AMP for Endpoints policy directly controls whether the connector sends a real-time alert to the management console when a file is determined to be malicious by the cloud sandbox (e.g., Threat Grid). This ensures immediate notification without relying on periodic polling or batch reporting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Send alerts for malicious files' in the AMP policy
Why this is correct
This setting triggers alerts when a file is determined malicious by cloud sandbox.
- ✗
Configure Syslog forwarding for all events
Why it's wrong here
Syslog forwarding sends events but does not by itself include sandbox verdict alerts unless the policy is configured.
- ✗
Enable 'Exploit Prevention' in block mode
Why it's wrong here
Exploit Prevention does not generate alerts for sandbox analysis.
- ✗
Set the connector to 'Analyze' mode
Why it's wrong here
Analyze mode submits files to cloud but does not automatically alert on malicious verdicts.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.