350-701 Endpoint Protection and Detection Practice Question
A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between a 'Connected' status (which only indicates a control-plane or registration state) and actual data-plane functionality (event uploads), leading candidates to overlook proxy or firewall egress issues that block HTTPS traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.
The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The AMP license has expired.
Why it's wrong here
An expired license would prevent the connector from registering or showing as 'Connected'.
- ✓
The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.
Why this is correct
The connector can establish a TCP connection (appear connected) but event submission over HTTPS fails through the proxy.
- ✗
Inbound firewall rules block incoming connections to the AMP connector.
Why it's wrong here
AMP connectors only initiate outbound connections; inbound rules are irrelevant.
- ✗
The AMP connector service is stopped on the endpoint.
Why it's wrong here
If the service were stopped, the connector status would show 'Disconnected', not 'Connected'.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.