hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A security analyst discovers that an endpoint was…
A security analyst discovers that an endpoint was infected by a file that initially received a 'clean' disposition from Cisco AMP. The analyst needs to identify all other endpoints that executed the same file and examine their trajectory. Which approach should be used to find these endpoints in the AMP console?
⚠ Common exam trap
Cisco often tests the distinction between searching for a file's SHA-256 hash (which directly lists all endpoints with that file) and using retrospective scans or IOC scanning, which serve different purposes and do not provide a simple list of affected endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search for the file's SHA-256 hash in the AMP console to see all endpoints with that file
Cisco AMP maintains a global file disposition database that maps SHA-256 hashes to all endpoints that have ever executed or stored that file. By searching for the file's SHA-256 hash in the AMP console, the analyst can instantly retrieve a list of all endpoints with that file, including those that received a 'clean' disposition before the file was later classified as malicious. This leverages AMP's cloud-based telemetry and file reputation system, enabling rapid identification of all affected systems without requiring additional scans or manual correlation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Search for the file's SHA-256 hash in the AMP console to see all endpoints with that file
Why this is correct
Searching by SHA-256 provides a list of all endpoints that have encountered the file, enabling trajectory analysis.
- ✗
Check the Device Trajectory of the infected endpoint and manually correlate with other endpoints
Why it's wrong here
Device Trajectory shows only that endpoint's history; correlation would require manual effort across many endpoints.
- ✗
Use the IOC scanning feature to scan all endpoints for the file's signature
Why it's wrong here
IOC scanning uses indicators, not file hash search, and is not the primary method for this task.
- ✗
Run a retrospective security scan on all endpoints using the file's SHA-256 hash
Why it's wrong here
Retrospective security is automatic; the analyst cannot manually initiate a scan by hash.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.