350-701 Endpoint Protection and Detection Practice Question
A global enterprise with over 20,000 endpoints has been using Cisco AMP for Endpoints for two years. They recently migrated to a new SIEM and want to forward AMP events in near real-time. The security operations team notices that the SIEM is receiving duplicate events for the same file execution, causing alert fatigue. The AMP console shows that the 'Send to Syslog' action is enabled on two different policies, and both policies are applied to the same groups of endpoints. The team also uses the AMP APIs to pull data. The network engineer wants to eliminate duplicate events without losing any critical alerts. Which course of action should the engineer take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.
Duplicate events occur because the same set of endpoints is covered by two different policies both with the 'Send to Syslog' action enabled. By reviewing the group hierarchy and ensuring each endpoint is assigned to a single policy that includes the syslog action, you eliminate duplicates while still forwarding all events. Option A (disable API) does not affect syslog duplicates; the API is a separate data source. Option B (increase detection interval) would not deduplicate events; it only changes the rate of detection. Option C (remove syslog action from one policy) might still cause duplicates if the other policy still applies to the same endpoints, and it could also affect other security settings in that policy. The proper approach is to maintain a clean policy assignment hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the AMP API to stop duplicates from multiple data sources.
Why it's wrong here
The API is not causing duplicates; the issue is multiple syslog actions.
- ✗
Increase the event detection interval to reduce the number of events generated.
Why it's wrong here
Does not address duplicates; may miss events.
- ✗
Remove the 'Send to Syslog' action from one of the two policies.
Why it's wrong here
This might resolve duplicates but could remove necessary events from endpoints that need both policies.
- ✓
Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.
Why this is correct
Eliminates duplicate policy application.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.