The answer is a proxy that does not allow HTTPS traffic to the AMP cloud. While the AMP connector status shows 'Connected' in the console, this only confirms a successful TCP handshake and authentication, not that event data is flowing. A proxy that permits the initial connection but blocks subsequent HTTPS (TCP/443) data-plane traffic will prevent event submission, creating a deceptive "connected but silent" state. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of the difference between control-plane connectivity and data-plane throughput, a common trap where candidates mistake a green status for full functionality. Remember the memory tip: "Connected does not mean communicating—proxy filters can kill the data stream."
350-701 Endpoint Protection and Detection Practice Question
This 350-701 practice question tests your understanding of endpoint protection and detection. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.
The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The AMP license has expired.
Why it's wrong here
An expired license would prevent the connector from registering or showing as 'Connected'.
✓
The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.
Why this is correct
The connector can establish a TCP connection (appear connected) but event submission over HTTPS fails through the proxy.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Inbound firewall rules block incoming connections to the AMP connector.
Why it's wrong here
AMP connectors only initiate outbound connections; inbound rules are irrelevant.
✗
The AMP connector service is stopped on the endpoint.
Why it's wrong here
If the service were stopped, the connector status would show 'Disconnected', not 'Connected'.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between a 'Connected' status (which only indicates a control-plane or registration state) and actual data-plane functionality (event uploads), leading candidates to overlook proxy or firewall egress issues that block HTTPS traffic.
Trap categories for this question
Command / output trap
An expired license would prevent the connector from registering or showing as 'Connected'.
Detailed technical explanation
How to think about this question
The AMP connector uses a persistent outbound HTTPS connection (TCP/443) to the AMP cloud for event reporting and policy updates. When a proxy is in the path, the connector must be configured with proxy settings (e.g., in the connector configuration file or via system proxy) to tunnel traffic. If the proxy blocks or does not forward traffic to the specific AMP cloud FQDNs (e.g., *.amp.cisco.com), the connector may show as 'Connected' due to a stale TCP session or a cached status in the console, but event uploads will fail silently. This scenario is common in environments using transparent proxies that intercept HTTPS but fail to whitelist the AMP cloud endpoints.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-701 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Endpoint Protection and Detection — This question tests Endpoint Protection and Detection — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud. — The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.