350-701 Endpoint Protection and Detection Practice Question
A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?
⚠ Common exam trap
Cisco often tests the misconception that outbound HTTPS access alone guarantees connectivity, when in fact DNS resolution is a separate prerequisite that must be verified, especially in environments with internal DNS servers or strict DNS filtering policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the endpoint can resolve the AMP cloud hostname using DNS.
The AMP connector must resolve the AMP cloud hostname (e.g., `amp.cisco.com`) via DNS to establish the HTTPS connection. Even if outbound HTTPS is allowed, a DNS resolution failure would prevent the endpoint from reaching the cloud, causing the 'Out-of-Date' status. Verifying DNS ensures the endpoint can translate the hostname to an IP address, which is a prerequisite for policy updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the AMP connector to use a static IP address for the cloud.
Why it's wrong here
The connector relies on DNS resolution; a static IP is not configurable.
- ✗
Reboot the endpoint to force a policy download.
Why it's wrong here
Rebooting is not a standard troubleshooting step; the connector polls automatically.
- ✗
Verify that SNMP is enabled on the endpoint.
Why it's wrong here
SNMP is not used for AMP cloud communication.
- ✓
Verify that the endpoint can resolve the AMP cloud hostname using DNS.
Why this is correct
The connector must resolve the cloud hostname for HTTPS connections.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.