350-701 Endpoint Protection and Detection Practice Question
A company wants to ensure that only authorized applications can run on endpoints. Which feature of Cisco AMP for Endpoints should be used to create a whitelist of allowed applications?
⚠ Common exam trap
Cisco often tests the distinction between 'Application Control' (whitelisting/blacklisting based on static criteria) and 'File Reputation' (cloud-based dynamic analysis), leading candidates to mistakenly choose File Reputation because they associate 'reputation' with trust, but it does not enforce a strict allowlist.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application Control
Application Control in Cisco AMP for Endpoints allows administrators to define a whitelist of approved applications by specifying SHA-256 hashes, file paths, or publisher certificates. This feature enforces a 'deny-by-default' policy, blocking any executable not explicitly allowed, which directly meets the requirement to ensure only authorized applications can run on endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Application Control
Why this is correct
Application Control allows whitelisting of approved applications and blocks unauthorized ones.
- ✗
Exploit Prevention
Why it's wrong here
Exploit Prevention blocks specific exploit techniques, not application execution.
- ✗
Orbital Advanced Search
Why it's wrong here
Orbital is for advanced endpoint querying, not application control.
- ✗
File Reputation
Why it's wrong here
File reputation checks files against known good/bad lists, but does not enforce whitelisting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.