350-701 Endpoint Protection and Detection Practice Question
An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?
⚠ Common exam trap
Cisco often tests the distinction between visibility features (Device Trajectory) and search or policy tools (File Search, Group Policy), trapping candidates who confuse file attribute lookup with process lineage analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device Trajectory to review the event timeline.
Device Trajectory provides a chronological timeline of events on the endpoint, allowing the responder to trace file executions back to their parent processes. By reviewing the trajectory, the responder can identify which files with unknown verdicts were spawned by a known malicious parent process, directly answering the investigation need.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Device Trajectory to review the event timeline.
Why this is correct
Device Trajectory shows process execution details and parent-child relationships.
- ✗
Group Policy to check applied policies.
Why it's wrong here
Group Policy does not show events.
- ✗
Dashboard to view overall threat scores.
Why it's wrong here
Dashboard is too high-level for detailed analysis.
- ✗
File Search to find files with unknown verdict.
Why it's wrong here
File Search does not show process lineage.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.