350-701 Endpoint Protection and Detection Practice Question
A security engineer is troubleshooting an issue where Cisco AMP for Endpoints is not detecting a known malware sample on a Windows endpoint. The endpoint is running Windows 10 with the latest AMP connector installed and is connected to the corporate network. The malware sample was downloaded from a trusted source for testing. Which configuration is most likely causing the lack of detection?
⚠ Common exam trap
Cisco often tests the misconception that disabling real-time scanning or file reputation scanning is the primary cause of missed detections, when in fact the connector's inability to communicate with the cloud (offline mode) is the most direct and common reason for failing to detect known malware.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The connector is configured to operate in offline mode.
When Cisco AMP for Endpoints is in offline mode, the connector cannot communicate with the cloud-based threat intelligence and reputation servers. This prevents it from performing file reputation lookups and retrieving the latest malware signatures, so even known malware samples will not be detected. The connector relies on cloud lookups for real-time detection of new or known threats, and offline mode disables this critical function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The connector is configured to operate in offline mode.
Why this is correct
In offline mode, the connector cannot perform cloud lookups for file hashes, so known malware may not be detected.
- ✗
The file reputation scanning is disabled.
Why it's wrong here
File reputation scanning is typically enabled by default; disabling it would affect detection, but the sample is known malware, so cloud lookup is more critical.
- ✗
Custom detections are not configured for the malware.
Why it's wrong here
Custom detections are for proprietary or unknown threats; known malware should be detected via cloud intelligence.
- ✗
Real-time scanning is disabled for the download directory.
Why it's wrong here
Real-time scanning would still detect the malware if cloud lookups were available; offline mode bypasses that.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.