The answer is to check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions. This is because Cisco AMP’s retrospective security feature relies on the cloud updating a file’s disposition from clean to malicious, but the actual remediation action—such as quarantine or deletion—only triggers automatically on endpoints if the 'Remediate Now' setting is active in the assigned policy. Without it, the cloud sends the updated verdict, but the endpoint simply logs the change without acting, which explains why AMP retroactive remediation not working remediate now is a common troubleshooting scenario. On the Cisco SCOR 350-701 exam, this tests your understanding of the distinction between retrospective detection and automated response; a frequent trap is assuming that enabling retrospective security alone is sufficient. Remember it as “disposition change without action is just a notification”—the ‘Remediate Now’ toggle is the trigger for enforcement.
350-701 Content Security Practice Question
This 350-701 practice question tests your understanding of content security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A multinational corporation uses Cisco AMP for Endpoints with cloud-based file reputation. The security team notices that a file that was previously determined to be clean (disposition: clean) is now reported as malicious by a threat intelligence feed. However, AMP has not taken any action on endpoints that already executed the file. The administrator confirms that retrospective security is enabled. What should the administrator check first to ensure that the file is remediated on all affected endpoints?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions.
Option C is correct because when a file's disposition changes from clean to malicious in the AMP cloud, the 'Remediate Now' policy setting controls whether AMP automatically triggers remediation actions (such as quarantine or deletion) on endpoints that have already executed the file. Even with retrospective security enabled, the administrator must ensure that the policy assigned to the endpoints has this option enabled; otherwise, the cloud will send the updated disposition but the endpoint will not automatically act on it.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Verify that the file is not excluded from scanning due to an anti-virus exclusion list.
Why it's wrong here
Exclusion prevents detection, not remediation.
✗
Confirm that the endpoints have internet connectivity to the AMP cloud.
Why it's wrong here
Endpoints likely have connectivity as file was initially analyzed.
✓
Check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions.
Why this is correct
Requires explicit setting.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Ensure that the file is being analyzed by the local AMP engine for accurate detection.
Why it's wrong here
Local analysis not needed for cloud disposition changes.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between 'retrospective security' being enabled (which allows the cloud to send updated dispositions) and the 'Remediate Now' policy setting (which controls whether the endpoint automatically acts on those updates), leading candidates to incorrectly assume that enabling retrospective security alone is sufficient for automatic remediation.
Detailed technical explanation
How to think about this question
Under the hood, Cisco AMP for Endpoints uses a cloud-based file reputation system where each file is assigned a disposition (clean, malicious, unknown). When a disposition changes, the cloud sends a 'retrospective alert' to the endpoint via the AMP connector. The 'Remediate Now' policy option (found under Policy > Advanced Settings) dictates whether the endpoint automatically executes the remediation action (e.g., quarantine, delete) upon receiving the alert. If disabled, the endpoint logs the alert but takes no action, requiring manual intervention. In real-world scenarios, administrators often enable this option to ensure zero-day threats that are later identified are automatically cleaned from all hosts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Content Security — This question tests Content Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions. — Option C is correct because when a file's disposition changes from clean to malicious in the AMP cloud, the 'Remediate Now' policy setting controls whether AMP automatically triggers remediation actions (such as quarantine or deletion) on endpoints that have already executed the file. Even with retrospective security enabled, the administrator must ensure that the policy assigned to the endpoints has this option enabled; otherwise, the cloud will send the updated disposition but the endpoint will not automatically act on it.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.