350-701 Endpoint Protection and Detection Practice Question
An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?
⚠ Common exam trap
Cisco often tests the distinction between global policy changes (like disabling detection or switching to audit mode) and targeted hash-based overrides, expecting candidates to recognize that the most precise and secure fix is to add the specific file hash to a custom allow list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.
The recommended action to prevent a known false positive from being flagged again is to add the file's SHA-256 hash to the custom detection list with an 'Allow' or 'Uncategorized' disposition. This overrides the local or cloud-based verdict for that specific file, ensuring AMP for Endpoints treats it as clean without affecting global detection policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Submit the file to Cisco TALOS for reanalysis.
Why it's wrong here
TALOS may update the global disposition, but for immediate false positive, local exception is faster.
- ✓
Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.
Why this is correct
Custom exceptions override global dispositions, preventing future false positives without affecting other protections.
- ✗
Disable AMP detection for that file type globally.
Why it's wrong here
Disabling detection for a file type weakens security; use specific exceptions.
- ✗
Change the AMP policy from 'Detect' to 'Audit' for the endpoint.
Why it's wrong here
Audit mode would stop alerts but also reduce visibility; not a targeted fix.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.