350-701 Endpoint Protection and Detection Practice Question
Exhibit
Refer to the exhibit. Cisco AMP for Endpoints event log: Event Type: Detection Threat: W32.Ransomware File Name: encrypt.exe File Path: C:\Users\test\Downloads\encrypt.exe Action: Blocked Disposition: Malware File Hash: a1b2c3d4e5f6... Event Type: Detection Threat: W32.Ransomware File Name: encrypt.exe File Path: C:\Users\test\AppData\Local\Temp\encrypt.exe Action: Blocked Disposition: Malware File Hash: a1b2c3d4e5f6... Event Type: TETRA Event Threat: W32.Ransomware File Name: encrypt.exe File Path: C:\Users\test\AppData\Roaming\encrypt.exe Action: Quarantine Disposition: Unknown File Hash: a1b2c3d4e5f6...
An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?
⚠ Common exam trap
Cisco often tests the misconception that a TETRA event is a separate detection type rather than a correlation mechanism, leading candidates to confuse it with a cloud communication error or a re-execution trigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.
The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.
Why it's wrong here
TETRA events are not error messages; they are part of the targeted execution analysis process.
- ✗
The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.
Why it's wrong here
The file was blocked in two locations, but TETRA events occur when a file with unknown disposition is executed, not because of previous blocks.
- ✗
The file was determined to be malicious by the cloud after the first detection.
Why it's wrong here
The disposition is 'Unknown' in the TETRA event, indicating the cloud has not yet classified it.
- ✓
The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.
Why this is correct
TETRA events are triggered when an unknown file is executed; the connector quarantines the file and sends it to the cloud for analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.