350-701 Endpoint Protection and Detection Practice Question
A security analyst sees multiple AMP events for 'Trojan.Generic.37283212' on several endpoints. After updating the AMP signatures, the detection still occurs. What is the best next step to reduce false positives?
⚠ Common exam trap
Cisco often tests the distinction between disabling a broad signature (which is too aggressive) and using a precise hash-based whitelist (which is the correct, surgical approach to handle false positives).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the file SHA256 hash to the Custom Whitelist in the AMP policy.
Adding the file SHA256 hash to the Custom Whitelist in the AMP policy explicitly tells the AMP cloud to ignore that specific file, preventing false positives without disabling broader protections. Since the detection persists after signature updates, the file is likely a legitimate application that is being incorrectly flagged by the generic heuristic signature 'Trojan.Generic.37283212'. Whitelisting the exact hash ensures that only this file is exempted, maintaining security for other threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wait for the next signature update that might remove the detection.
Why it's wrong here
Signatures are updated by Cisco; waiting may take time and the detection may be legitimate.
- ✓
Add the file SHA256 hash to the Custom Whitelist in the AMP policy.
Why this is correct
Whitelisting the specific file hash prevents future false positives while retaining protection.
- ✗
Disable the signature for Trojan.Generic in the AMP policy.
Why it's wrong here
Disabling the entire signature class would expose the organization to other threats.
- ✗
Reinstall the AMP connector on the affected endpoints.
Why it's wrong here
Reinstalling does not change detection logic; false positives will persist.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.