350-701 Endpoint Protection and Detection Practice Question
A security analyst observes that one endpoint is generating Alerts of type 'Trojan' in Cisco AMP, but other identical endpoints on the same software version show no issues. After verifying that the signature versions are consistent, what is the most likely cause of the discrepancy?
⚠ Common exam trap
Cisco often tests the concept that false positives are a common cause of isolated alerts, tempting candidates to choose a misconfiguration or network issue, but the key is that identical endpoints with the same signatures rule out global problems, leaving a local behavioral anomaly as the most likely cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature
In Cisco AMP, a single endpoint generating 'Trojan' alerts while identical peers remain clean, with consistent signature versions, strongly indicates a false positive caused by a legitimate application exhibiting behavior that matches a Trojan signature. AMP uses behavioral analysis and signature-based detection; if a benign application performs actions (e.g., file writes, registry modifications, or network connections) that resemble known malware patterns, it can trigger an alert. Since other endpoints with the same software and signatures are unaffected, the issue is localized to that specific endpoint's unique application or configuration, not a global misconfiguration or signature issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature
Why this is correct
AMP's behavioral analysis might flag a legitimate application if it behaves like malware. Other endpoints may not have that app.
- ✗
The AMP connector is misconfigured and is generating false alerts
Why it's wrong here
If all connectors are same config, this would affect all endpoints, not just one.
- ✗
The endpoint's network traffic is being intercepted by a proxy causing AMP to misidentify it
Why it's wrong here
AMP analyzes file behavior, not network traffic for trojan detection.
- ✗
The endpoint has an outdated operating system patch
Why it's wrong here
While possible, if all endpoints have same patches, this is not the most likely cause given identical software versions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.