350-701 Endpoint Protection and Detection Practice Question
A security engineer wants to implement file reputation analysis using Cisco AMP for Endpoints. The policy must block files that are known to be malicious in the cloud and quarantine unknown files for further analysis. Which AMP policy configuration achieves this?
⚠ Common exam trap
Cisco often tests the distinction between 'Block' and 'Quarantine' actions in File Reputation rules, where candidates may mistakenly think 'Unknown -> Allow' is acceptable, but the exam requires understanding that unknown files must be quarantined for further analysis, not allowed to execute.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.
Cisco AMP for Endpoints File Reputation rules allow granular control over file disposition. Setting 'Malware -> Block' ensures files with a known malicious disposition are prevented from executing, while 'Unknown -> Quarantine' sends files with an unknown disposition to the AMP cloud for retrospective analysis and containment. This directly matches the requirement to block known threats and quarantine unknowns for further analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.
Why this is correct
This matches the requirement to block known malware and quarantine unknown files.
- ✗
Create a policy with Application Control to block all executables from the internet.
Why it's wrong here
Application Control is for controlling allowed applications, not file reputation.
- ✗
Create a policy with File Reputation rules: Malware -> Block, Unknown -> Allow.
Why it's wrong here
Unknown files are allowed, not quarantined.
- ✗
Create a policy with Custom Detection rules for specific SHA256 hashes only.
Why it's wrong here
Custom detection does not use cloud reputation; it relies on static hashes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.