Understanding Quarantine Triggered by Local Analysis
Exhibit
Refer to the exhibit. ``` Cisco Secure Endpoint Connector Log [2025-03-15 10:23:45] File scan initiated: C:\Users\jdoe\Downloads\invoice.pdf.exe [2025-03-15 10:23:46] File reputation check: SHA256=2a3b...c4d5 [2025-03-15 10:23:46] Cloud lookup: result=UNKNOWN [2025-03-15 10:23:47] File disposition: UNKNOWN [2025-03-15 10:23:47] Local analysis: verdict=Malicious (score=85) [2025-03-15 10:23:47] Action: Quarantine file ```
Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?
Quick Answer
The correct answer is that the cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine. This occurs because Cisco Secure Endpoint operates with a multi-layered detection engine: when a file’s cloud reputation returns an unknown verdict, the connector immediately shifts to quarantine based on local analysis after unknown cloud verdict, using static analysis and behavioral monitoring to assess the file locally. In this case, the file ‘invoice.pdf.exe’ was flagged by that local analysis as malicious, prompting the quarantine action. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of the endpoint’s fallback logic and the distinction between cloud-dependent and local detection modes. A common trap is assuming quarantine always requires a known malicious cloud verdict; instead, remember that unknown cloud results trigger deeper local inspection. Memory tip: “Unknown cloud? Local crowd.” — when the cloud is unsure, the local engine takes the floor.
⚠ Common exam trap
Cisco often tests the distinction between cloud reputation, local analysis, and retrospective analysis — the trap here is assuming that quarantine always requires a malicious cloud verdict, when in fact local analysis can independently trigger quarantine when the cloud verdict is unknown.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.
The log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file was blocked at execution time by Exploit Prevention.
Why it's wrong here
The file was quarantined upon scan, not at execution.
- ✓
The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.
Why this is correct
Log shows cloud result UNKNOWN, then local analysis verdict Malicious.
- ✗
The cloud reputation determined the file was malicious and instructed the connector to quarantine.
Why it's wrong here
Cloud result was UNKNOWN, not malicious.
- ✗
The file was executed and then reverted by the retrospective engine.
Why it's wrong here
No execution occurred; file was quarantined on scan.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?
hard- A.The cloud analysis result was delayed due to high traffic.
- B.The local analysis engine was disabled, so the file was not analyzed locally.
- ✓ C.The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.
- D.The endpoint did not have connectivity to the AMP cloud at the time of execution.
Why C: C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.