350-701 Endpoint Protection and Detection Practice Question
A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?
⚠ Common exam trap
Cisco often tests the misconception that maximum protection (Block mode) should be applied immediately, but the trap is that they want you to recognize the operational necessity of a phased deployment (Audit/Detect first) to avoid business disruption and ensure policy accuracy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.
Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable file analysis for known good file types to improve performance.
Why it's wrong here
Disabling analysis may miss threats; instead, use exclusions carefully.
- ✓
Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.
Why this is correct
Audit/Detect modes allow identification of false positives and tuning before enforcement.
- ✗
Set the policy to 'Block' immediately to maximize protection.
Why it's wrong here
Immediate blocking can disrupt legitimate applications; phased rollout is recommended.
- ✗
Disable AMP's network firewall to reduce complexity.
Why it's wrong here
The firewall provides additional endpoint security; disabling it reduces protection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.