350-701 Endpoint Protection and Detection Practice Question
A security engineer notices that several endpoints in the HR department have been infected with ransomware despite having Cisco AMP for Endpoints deployed. The AMP policy is set to 'Detect' for all file types. What is the most likely reason the ransomware was not blocked?
⚠ Common exam trap
Cisco often tests the distinction between 'Detect' and 'Block' actions in AMP policies, as candidates may assume that any detection capability automatically prevents execution, but 'Detect' is purely alerting without enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.
Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The endpoints had process exclusions that allowed the ransomware process.
Why it's wrong here
Process exclusions would need to be explicitly configured; the default mode is the culprit.
- ✓
The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.
Why this is correct
The 'Detect' mode only generates alerts without taking preventive action.
- ✗
The AMP cloud was unreachable during the infection attempt.
Why it's wrong here
If the cloud was unreachable, the agent would fall back to local analysis, but still might detect; the policy mode is the primary issue.
- ✗
The file was too large for cloud analysis and AMP timed out.
Why it's wrong here
File size limits exist but typically still result in a disposition; the policy mode overrides.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.