350-701 Endpoint Protection and Detection Practice Question
An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?
⚠ Common exam trap
Cisco often tests the misconception that a firewall (like Firepower NGFW) is the primary tool for host isolation, but the trap here is that endpoint isolation requires network access control (NAC) integration via ISE and pxGrid, not just traffic filtering at the perimeter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco ISE with pxGrid
Cisco ISE with pxGrid (Platform Exchange Grid) enables automated policy-based responses by allowing Cisco AMP for Endpoints to share threat intelligence with ISE. When AMP detects a high-severity malware, it triggers a pxGrid event that instructs ISE to dynamically quarantine the host by applying a security group access control list (SGACL) or a CoA (Change of Authorization) to block network access. This integration is specifically designed for context sharing and automated remediation across Cisco security products.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco Stealthwatch with NetFlow
Why it's wrong here
Stealthwatch monitors but does not enforce endpoint isolation.
- ✗
Cisco Web Security Appliance
Why it's wrong here
WSA proxies web traffic, not endpoint isolation.
- ✗
Cisco Firepower Next-Gen Firewall
Why it's wrong here
Firepower can block but cannot directly isolate an endpoint from the network based on AMP detection.
- ✓
Cisco ISE with pxGrid
Why this is correct
pxGrid enables AMP to send isolation commands to ISE, which then changes the endpoint's network access.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.