mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: A security analyst notices that a file that was…
A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device Trajectory
Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exploit Prevention
Why it's wrong here
Exploit Prevention focuses on memory injection protection, not file propagation history.
- ✗
Endpoint IOC scanning
Why it's wrong here
IOC scanning checks for indicators of compromise on endpoints but does not show propagation history.
- ✗
SHA-256 file disposition
Why it's wrong here
SHA-256 disposition shows the current classification (clean/malicious/unknown) but not the propagation timeline.
- ✓
Device Trajectory
Why this is correct
Device Trajectory provides a timeline of file activity and propagation across endpoints.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.