350-701 Endpoint Protection and Detection Practice Question
An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?
⚠ Common exam trap
Cisco often tests the misconception that AMP for Endpoints relies on a traditional signature database (like a .dat file) that can become outdated, when in fact the primary detection mechanism is cloud-based with a local cache that is not a full signature database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The endpoint's AMP connector has local analysis disabled, preventing hash matching.
When AMP for Endpoints fails to detect a file that is known to be malicious (based on its hash) and other endpoints have already detected it, the most likely cause is that local analysis (also known as local scanning or local hash matching) is disabled on the failing endpoint. AMP for Endpoints uses a combination of cloud-based lookups and local analysis. If local analysis is disabled, the endpoint cannot perform hash-based detection against its local cache or signature database, and it must rely entirely on cloud connectivity. If the cloud lookup is delayed or the endpoint is offline, detection fails. Option B directly addresses this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The AMP connector is not configured with a proxy when needed.
Why it's wrong here
Proxy misconfiguration affects cloud connectivity, but the file might have been detected by other endpoints with similar connectivity.
- ✓
The endpoint's AMP connector has local analysis disabled, preventing hash matching.
Why this is correct
Local analysis allows matching known bad hashes without cloud lookup; if disabled, detection may rely solely on cloud.
- ✗
The AMP signature database on that endpoint is outdated.
Why it's wrong here
Signature updates are automatic; if other endpoints detect, the database is likely current.
- ✗
The AMP policy is set to 'Block' instead of 'Detect'.
Why it's wrong here
Policy mode affects actions, not the ability to detect; detection still occurs.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.