350-701 Endpoint Protection and Detection Practice Question
An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?
⚠ Common exam trap
Cisco often tests the distinction between local and cloud analysis phases, and the trap here is that candidates assume 'Unknown' means the file was not analyzed at all, when in fact it means the local analysis could not determine maliciousness and the policy action for unknown files is the deciding factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.
C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cloud analysis result was delayed due to high traffic.
Why it's wrong here
If the policy had blocked unknowns, the file would have been blocked regardless of delay.
- ✗
The local analysis engine was disabled, so the file was not analyzed locally.
Why it's wrong here
Local analysis typically does not handle unknown files; they are sent to the cloud.
- ✓
The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.
Why this is correct
Unknown files may be allowed until the cloud verdict returns; if the action is not 'Block', execution occurs.
- ✗
The endpoint did not have connectivity to the AMP cloud at the time of execution.
Why it's wrong here
Without connectivity, the file would be unknown and handled per local policy; still could be allowed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.