Courseiva

CCNA Endpoint Protection and Detection Questions

75 of 78 questions · Page 1/2 · Endpoint Protection and Detection · Answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Select 2 answers
A.File Reputation
B.Exploit Prevention
C.Malware Analytics (sandboxing)
D.Application Control
E.Device Control
AnswersB, C

Exploit Prevention protects against exploit techniques used by zero-day attacks.

Why this answer

Exploit Prevention (B) is correct because it uses exploit-specific signatures and behavioral monitoring to block common exploitation techniques (e.g., heap spray, ROP, SEH overwrite) without relying on known malware signatures, making it effective against zero-day exploits. Malware Analytics (C) is correct because it detonates suspicious files in a sandboxed environment to analyze behavior and detect previously unknown threats, providing protection against zero-day malware before signatures are available.

Exam trap

Cisco often tests the distinction between signature-based detection (File Reputation) and behavior-based detection (Exploit Prevention and Malware Analytics), leading candidates to mistakenly choose File Reputation because they assume it covers all unknown threats.

Practice this question →
2
MCQmedium

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

A.Device Trajectory to review the event timeline.
B.Group Policy to check applied policies.
C.Dashboard to view overall threat scores.
D.File Search to find files with unknown verdict.
AnswerA

Device Trajectory shows process execution details and parent-child relationships.

Why this answer

Device Trajectory provides a chronological timeline of events on the endpoint, allowing the responder to trace file executions back to their parent processes. By reviewing the trajectory, the responder can identify which files with unknown verdicts were spawned by a known malicious parent process, directly answering the investigation need.

Exam trap

Cisco often tests the distinction between visibility features (Device Trajectory) and search or policy tools (File Search, Group Policy), trapping candidates who confuse file attribute lookup with process lineage analysis.

How to eliminate wrong answers

Option B is wrong because Group Policy is a configuration management tool for applying security policies, not a forensic analysis feature for reviewing process execution chains. Option C is wrong because the Dashboard provides aggregate threat scores and high-level visibility, not the granular, per-file parent-child process relationship needed here. Option D is wrong because File Search only locates files by attributes like hash or name, but does not show the execution context or parent process lineage required to identify malicious parent-child relationships.

Practice this question →
3
MCQmedium

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

A.Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.
B.Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.
C.Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.
D.Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.
AnswerB

TETRA provides real-time traffic analysis; the console allows immediate visibility and isolation.

Why this answer

Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Exam trap

Cisco often tests the misconception that disabling security controls (like the firewall) will improve detection, when in fact the TETRA engine operates independently and isolation is the correct containment step.

How to eliminate wrong answers

Option A is wrong because disabling the built-in firewall removes a critical layer of defense and does not improve TETRA's inspection; TETRA operates independently of the host firewall. Option C is wrong because waiting for a weekly Talos report is too slow for an active threat, and signature updates are reactive rather than providing immediate containment. Option D is wrong because reinstalling the connector with a fresh policy is disruptive, time-consuming, and does not address the need for rapid root cause analysis and containment.

Practice this question →
4
MCQeasy

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

A.The AMP license has expired.
B.The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.
C.Inbound firewall rules block incoming connections to the AMP connector.
D.The AMP connector service is stopped on the endpoint.
AnswerB

The connector can establish a TCP connection (appear connected) but event submission over HTTPS fails through the proxy.

Why this answer

The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Exam trap

Cisco often tests the distinction between a 'Connected' status (which only indicates a control-plane or registration state) and actual data-plane functionality (event uploads), leading candidates to overlook proxy or firewall egress issues that block HTTPS traffic.

How to eliminate wrong answers

Option A is wrong because an expired AMP license would prevent the connector from authenticating or registering, resulting in a 'Disconnected' or 'Unlicensed' status, not 'Connected'. Option C is wrong because inbound firewall rules block incoming connections to the endpoint, but the AMP connector initiates outbound HTTPS connections to the cloud; inbound rules are irrelevant for event uploads. Option D is wrong because if the AMP connector service is stopped on the endpoint, the connector would not be able to maintain a 'Connected' status in the AMP console; the status would show 'Disconnected' or 'Offline'.

Practice this question →
5
Multi-Selecthard

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Select 2 answers
A.Scan
B.Monitor
C.Quarantine
D.Block
E.Delete
AnswersC, D

Quarantine moves the file to a secure location and prevents access.

Why this answer

In an AMP policy rule, the valid action types that can be assigned to a file are 'Quarantine' and 'Block'. Quarantine isolates the file to prevent execution or spread, while Block denies access to the file entirely. Both are core enforcement actions in Cisco AMP for Endpoints, used to stop threats based on file reputation or analysis.

Exam trap

Cisco often tests the distinction between 'Monitor' (a detection mode that logs but does not act) and actual enforcement actions like 'Block' or 'Quarantine', leading candidates to incorrectly select 'Monitor' as a valid action.

Practice this question →
6
MCQeasy

A small business uses Cisco AMP for Endpoints with a cloud-based console. The owner receives an email from Cisco that the AMP connector on a specific endpoint has gone offline. The endpoint is a Windows 10 laptop used for remote work. The owner checks the AMP console and sees the endpoint's last check-in was three days ago. The owner contacts the remote user, who says the laptop is running normally and they can access the internet. What should the owner do to resolve the issue?

A.Instruct the user to disable Windows Firewall temporarily.
B.Ask the user to install the latest Windows updates.
C.Ask the user to uninstall and reinstall the AMP connector.
D.Instruct the user to restart the AMP connector service (Cisco AMP for Endpoints Connector).
AnswerD

Restarting the service often resolves check-in issues.

Why this answer

The AMP connector on the endpoint may have a stopped or crashed service. Restarting the Cisco AMP for Endpoints Connector service will re-establish communication with the cloud console. Option A (disable firewall) is unnecessary and could reduce security; internet access works so firewall is likely not blocking.

Option B (install Windows updates) is unrelated to the connector's offline status. Option C (reinstall connector) is an extreme measure that should only be attempted after simpler steps like restarting the service fail.

Practice this question →
7
MCQmedium

Refer to the exhibit. The file invoice.pdf was determined to be malicious by the AMP cloud, yet the endpoint allowed it to execute. What is the most likely reason?

A.The endpoint was not up to date with the latest AMP connector patches.
B.The AMP policy was configured to allow files with a certain confidence level or based on a custom rule.
C.The file was not analyzed locally because local analysis was disabled.
D.The AMP connector lost connectivity after sending the file and fell back to a local allow policy.
AnswerB

The log explicitly states the action was due to a policy rule that allows on low confidence, overriding the malicious determination.

Why this answer

The AMP for Endpoints connector sends a SHA-256 hash of the file to the AMP cloud for analysis. If the cloud determines the file is malicious but the endpoint still allows execution, the most likely reason is that the AMP policy has been configured with a custom rule or a confidence threshold that permits files at that specific malicious confidence level. This overrides the default block action for known malware.

Exam trap

Cisco often tests the misconception that if AMP cloud marks a file as malicious, the endpoint must block it; the trap here is that policy overrides (custom rules or confidence thresholds) can allow execution despite a malicious verdict.

How to eliminate wrong answers

Option A is wrong because the AMP connector updates are for the connector software itself, not for the malware signatures or cloud analysis; the cloud already identified the file as malicious, so a connector patch would not change the outcome. Option C is wrong because local analysis (e.g., using the local malware engine) is a separate feature that can be enabled or disabled, but the question states the AMP cloud already analyzed the file and found it malicious, so local analysis is irrelevant to the cloud verdict. Option D is wrong because if the connector lost connectivity, it would fall back to a 'local allow' policy only if configured to do so, but the exhibit shows the cloud received and analyzed the file (it was determined malicious), so connectivity was present; the fallback behavior would not apply.

Practice this question →
8
MCQhard

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

A.The file was blocked at execution time by Exploit Prevention.
B.The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.
C.The cloud reputation determined the file was malicious and instructed the connector to quarantine.
D.The file was executed and then reverted by the retrospective engine.
AnswerB

Log shows cloud result UNKNOWN, then local analysis verdict Malicious.

Why this answer

The log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.

Exam trap

Cisco often tests the distinction between cloud reputation, local analysis, and retrospective analysis — the trap here is assuming that quarantine always requires a malicious cloud verdict, when in fact local analysis can independently trigger quarantine when the cloud verdict is unknown.

How to eliminate wrong answers

Option A is wrong because Exploit Prevention blocks exploits at execution time by monitoring for specific exploit techniques (e.g., heap spray, ROP), not by analyzing file reputation or behavior after execution; the log indicates quarantine after analysis, not a block at execution. Option C is wrong because the cloud reputation was unknown, not malicious; if the cloud had determined the file was malicious, it would have instructed the connector to block or quarantine immediately without requiring local analysis. Option D is wrong because the retrospective engine reverts files after they have been executed and later found malicious via cloud or local analysis; the log shows quarantine during the initial analysis, not a post-execution revert.

Practice this question →
9
MCQeasy

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

A.The file will be held until the endpoint comes online and a cloud lookup completes.
B.The file will be quarantined due to the aggressive exploit prevention level.
C.The file will be allowed because local cache will store an unknown disposition.
D.The file will be blocked immediately by scan-on-write.
AnswerC

Local cache stores unknown disposition; file is allowed until cloud lookup can be performed later.

Why this answer

When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Exam trap

Cisco often tests the misconception that offline endpoints will block or quarantine unknown files, when in fact the default behavior is to allow them based on local cache and policy settings for unknown dispositions.

How to eliminate wrong answers

Option A is wrong because Cisco Secure Endpoint does not hold files in a pending state when offline; it uses local caching and allows unknown files by default rather than queuing them for later cloud lookup. Option B is wrong because the aggressive exploit prevention level does not cause file quarantine for offline downloads; exploit prevention focuses on behavioral analysis and exploit detection, not on offline file disposition decisions. Option D is wrong because scan-on-write is a real-time scanning feature that blocks files based on known malware signatures, but it cannot block a file with an unknown disposition when the endpoint is offline and no local signature match exists.

Practice this question →
10
MCQmedium

An organization is deploying Cisco Secure Endpoint (AMP) in a high-security environment where endpoints are air-gapped from the internet. The security team needs to maintain up-to-date threat intelligence without direct cloud access. They have a dedicated local server that can download feeds from the AMP cloud once and distribute to endpoints. The server runs the AMP Private Cloud software. However, after installation, endpoints are not receiving updates. The team verifies that the Private Cloud server can reach the AMP cloud via a managed proxy. The endpoints can communicate with the Private Cloud server on TCP 443. What is the most likely cause of the update failure?

A.The proxy is not properly configured to allow HTTPS from the Private Cloud to the AMP cloud.
B.The Private Cloud appliance has not been registered and licensed in the AMP console.
C.The endpoints are using an incorrect certificate to authenticate to the Private Cloud.
D.The Private Cloud server's disk is full, preventing new update downloads.
AnswerB

Registration is required to sync threat intelligence.

Why this answer

The Private Cloud must be registered and licensed with Cisco to receive updates. Without registration, it cannot download threat intelligence. Option A (proxy misconfiguration) is possible but the team verified the proxy works.

Option C (endpoint certificate issue) is less likely; endpoints authenticate via policy. Option D (Private Cloud out of disk space) would log errors, but not the primary cause if the server is newly set up.

Practice this question →
11
MCQhard

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

A.The switch drops all traffic from the host with source IP 192.168.1.20.
B.The switch sends an ARP probe to verify the IP is unused, then updates the binding.
C.The switch updates the binding table to allow 192.168.1.20.
D.The switch allows the traffic because the host is trusted on that port.
AnswerA

IP Source Guard filters traffic based on the binding table; unmatched source IPs are dropped.

Why this answer

IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Exam trap

Cisco often tests the misconception that IP Source Guard allows traffic from a trusted host or that it dynamically updates bindings via ARP, when in fact it strictly enforces the DHCP snooping binding table and drops any non-matching traffic.

How to eliminate wrong answers

Option B is wrong because IP Source Guard does not send ARP probes; it simply drops traffic that does not match the DHCP snooping binding, and it does not dynamically update bindings based on ARP. Option C is wrong because the binding table is only updated via DHCP snooping (DHCP ACK messages) or static configuration, not by the host arbitrarily changing its IP address. Option D is wrong because the host is not configured as a trusted port for DHCP snooping; trust is applied to uplink ports (e.g., toward the DHCP server), not to access ports like GigabitEthernet0/2.

Practice this question →
12
Matchingmedium

Match each threat type to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Fraudulent emails to steal sensitive info

Malware that encrypts data for ransom

Distributed attack to overwhelm a service

Attacker intercepts communications

Attack on unknown vulnerability

Why these pairings

Correct matches: DDoS = traffic flood, Phishing = fraudulent emails, Malware = malicious software, Ransomware = encryption extortion. Common confusions: associating DDoS with encryption or phishing with traffic overload.

Practice this question →
13
MCQmedium

A security engineer wants to implement file reputation analysis using Cisco AMP for Endpoints. The policy must block files that are known to be malicious in the cloud and quarantine unknown files for further analysis. Which AMP policy configuration achieves this?

A.Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.
B.Create a policy with Application Control to block all executables from the internet.
C.Create a policy with File Reputation rules: Malware -> Block, Unknown -> Allow.
D.Create a policy with Custom Detection rules for specific SHA256 hashes only.
AnswerA

This matches the requirement to block known malware and quarantine unknown files.

Why this answer

Cisco AMP for Endpoints File Reputation rules allow granular control over file disposition. Setting 'Malware -> Block' ensures files with a known malicious disposition are prevented from executing, while 'Unknown -> Quarantine' sends files with an unknown disposition to the AMP cloud for retrospective analysis and containment. This directly matches the requirement to block known threats and quarantine unknowns for further analysis.

Exam trap

Cisco often tests the distinction between 'Block' and 'Quarantine' actions in File Reputation rules, where candidates may mistakenly think 'Unknown -> Allow' is acceptable, but the exam requires understanding that unknown files must be quarantined for further analysis, not allowed to execute.

How to eliminate wrong answers

Option B is wrong because Application Control blocks executables based on source (e.g., internet) rather than file reputation or disposition, which does not address the requirement for cloud-based file reputation analysis. Option C is wrong because setting 'Unknown -> Allow' would permit unknown files to execute without quarantine, failing the requirement to quarantine unknowns for further analysis. Option D is wrong because Custom Detection rules based on specific SHA256 hashes only block or detect known hashes, but do not leverage cloud reputation for unknown files or provide dynamic quarantine of unknown dispositions.

Practice this question →
14
MCQmedium

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

A.Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.
B.Configure the AMP connectors to send Syslog events to the FMC.
C.Deploy an on-premises AMP console to forward events to FMC.
D.Configure the Firepower NGFW to be the default gateway for the endpoints.
AnswerA

The integration uses API calls between FMC and AMP cloud to exchange threat intelligence.

Why this answer

Cisco AMP for Endpoints integrates with Firepower Management Center (FMC) via the AMP cloud API. To enable this, the FMC must have the AMP integration enabled and be configured with the correct API credentials (Client ID and API Key) from the AMP cloud console. This allows the FMC to pull endpoint detection events directly from the AMP cloud, correlating them with network-based detections from the Firepower NGFW.

Exam trap

Cisco often tests the misconception that on-premises components or Syslog are required for AMP-FMC integration, when in fact the integration relies solely on cloud-based API credentials and does not involve Syslog or an on-premises AMP console.

How to eliminate wrong answers

Option B is wrong because AMP connectors do not send Syslog events to FMC; AMP for Endpoints uses the cloud-based API for event sharing, not Syslog forwarding. Option C is wrong because AMP for Endpoints is a cloud-managed solution and does not require or support an on-premises console to forward events to FMC; the integration is direct via the AMP cloud. Option D is wrong because configuring the Firepower NGFW as the default gateway for endpoints is unrelated to AMP integration; it would affect network routing but not enable event sharing between AMP and FMC.

Practice this question →
15
MCQhard

A security analyst is investigating a malware incident on an endpoint protected by Cisco AMP for Endpoints. The Device Trajectory shows that a file named 'invoice.exe' was detonated from a USB drive. The file's cloud verdict was 'Unknown' at the time of execution. The analyst sees that the file spawned multiple child processes that made outbound connections to a malicious IP. The AMP policy has 'Exploit Prevention' enabled but 'File Reputation' is set to 'Monitor' only. The analyst wants to prevent similar incidents in the future without blocking legitimate applications. Which action should the analyst recommend?

A.Block all execution of applications from removable media via Group Policy.
B.Enable all Exploit Prevention rules, including those for script-based attacks.
C.Add the SHA256 hash of 'invoice.exe' to the global blacklist.
D.Change the File Reputation setting to 'Block' for files with 'Unknown' disposition.
AnswerD

Prevents execution of unknown files while allowing known good files.

Why this answer

Changing the File Reputation setting to 'Block' for files with 'Unknown' disposition would prevent unknown files like 'invoice.exe' from executing in the future, while still allowing files with known good reputations. This balances security with usability. Option A (blocking all USB execution via Group Policy) is too restrictive as it would block legitimate applications from removable media.

Option B (enabling all Exploit Prevention rules) targets exploit techniques, not malware executables like 'invoice.exe'. Option C (adding the hash to a global blacklist) is reactive and would only block that specific hash, not similar unknown files.

Practice this question →
16
MCQeasy

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

A.The connector is disconnected from the cloud and requires a reboot.
B.The connector is in a quarantine mode due to a loss of cloud connectivity.
C.The connector is permanently blocked by a firewall and needs manual reconfiguration.
D.The network component is disabled, preventing network traffic monitoring.
AnswerB

'Isolated' indicates the connector cannot reach the cloud but continues to protect with local rules.

Why this answer

In Cisco AMP (Advanced Malware Protection) for Endpoints, the 'Isolated: Yes' status indicates that the connector has entered quarantine mode because it has lost connectivity to the AMP cloud. This is a security feature that prevents the endpoint from communicating with other hosts on the network while still allowing outbound traffic to the cloud for reconnection attempts. The connector remains functional but isolated to contain potential threats until cloud connectivity is restored.

Exam trap

Cisco often tests the misconception that 'Isolated: Yes' means the connector is completely disabled or blocked by a firewall, when in fact it is a deliberate quarantine mode triggered by loss of cloud connectivity, not a permanent failure.

How to eliminate wrong answers

Option A is wrong because the connector is not disconnected from the cloud; it has lost connectivity, which triggers isolation, and a reboot is not required to resolve the issue—re-establishing cloud connectivity will automatically lift isolation. Option C is wrong because the connector is not permanently blocked by a firewall; isolation is a temporary, software-enforced state that can be cleared once connectivity is restored, and manual reconfiguration is not needed unless a persistent firewall rule is the root cause. Option D is wrong because the network component is not disabled; the connector still monitors traffic and enforces policies, but it restricts communication to other hosts while in isolation mode.

Practice this question →
17
Multi-Selectmedium

Which TWO of the following are valid detection methods used by Cisco AMP for Endpoints to identify malicious activity?

Select 2 answers
A.Exploit Prevention using vulnerability-based rules
B.Heuristic analysis of unknown files
C.File Reputation via cloud lookups
D.Anomaly-based behavioral detection
E.Signature-based IPS scanning
AnswersA, C

AMP Exploit Prevention blocks exploitation techniques.

Why this answer

Cisco AMP for Endpoints includes Exploit Prevention, which uses vulnerability-based rules to detect and block exploit attempts targeting specific software vulnerabilities. These rules are tailored to the exploit technique rather than the malware file itself, allowing protection against zero-day exploits that leverage known vulnerabilities.

Exam trap

Cisco often tests the distinction between AMP for Endpoints and other Cisco security products (like Firepower IPS), leading candidates to incorrectly select signature-based IPS scanning as an AMP detection method.

Practice this question →
18
MCQmedium

A university IT team manages 1,000 macOS laptops for students using Cisco AMP for Endpoints. They receive reports that some students' laptops are running slowly and fans are spinning constantly. The team checks the AMP console and sees that these endpoints are performing constant file scans on user directories. The team suspects that the AMP scanning is causing high CPU usage. They want to optimize performance without compromising security. The laptops use the default AMP policy with real-time scanning enabled. What should the team do?

A.Reduce the number of alert notifications to limit AMP's background activity.
B.Increase the file scanning interval to every 30 seconds instead of real-time.
C.Add exclusions for common user data directories in the AMP policy.
D.Disable real-time scanning and rely on scheduled scans.
AnswerC

Reduces scanning of trusted files, lowering CPU usage.

Why this answer

Adding exclusions for common user data directories (e.g., Documents, Downloads) reduces unnecessary scanning of files that are unlikely to be malicious, thereby lowering CPU usage without compromising security. Real-time scanning remains enabled for all other locations. Option A (reducing alert notifications) does not affect scanning frequency or CPU usage.

Option B (increasing scanning interval) is not applicable to real-time scanning, which continuously monitors file operations. Option D (disabling real-time scanning) would leave endpoints vulnerable to real-time threats.

Practice this question →
19
Matchingmedium

Match each security technology to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Detect and block malicious traffic inline

Monitor and alert on suspicious activity

Control access based on rules

Protect web applications from attacks

Encrypt traffic over public networks

Why these pairings

Firewall filters traffic based on rules; IDS/IPS monitors for threats; VPN provides secure tunnels; NAC enforces compliance. Common mistakes include confusing IDS/IPS with firewall and NAC with VPN.

Practice this question →
20
Multi-Selecteasy

Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?

Select 2 answers
A.Allow the file after a scan
B.Block execution of the file
C.Encrypt the file to prevent harm
D.Delete the file
E.Quarantine the file into a safe location
AnswersB, E

Block prevents the file from running.

Why this answer

Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.

Exam trap

Cisco often tests the distinction between 'Block execution' and 'Quarantine' as the only two direct actions available for malicious files, tricking candidates into selecting 'Delete' or 'Allow' which are not supported actions in the AMP for Endpoints console.

Practice this question →
21
Multi-Selecteasy

Which TWO of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Select 2 answers
A.The endpoint's last login time
B.The version of the operating system
C.MD5 hash of a malicious file
D.IP address of a command-and-control server
E.The username of the logged-in user
AnswersC, D

File hashes are common IOCs.

Why this answer

Cisco AMP for Endpoints uses file reputation analysis based on cryptographic hashes, including MD5, to identify known malicious files. When an endpoint attempts to execute or download a file, AMP computes its MD5 hash and compares it against a cloud-based threat intelligence database; a match indicates a known malware sample and is a clear indicator of compromise.

Exam trap

Cisco often tests the distinction between static system information (like OS version or usernames) and dynamic threat indicators (like file hashes and C2 IPs) to see if candidates understand that AMP for Endpoints is a threat detection tool, not a system inventory or authentication monitor.

Practice this question →
22
MCQeasy

During a ransomware attack, an endpoint protected by AMP for Endpoints successfully blocked the ransomware file. Which AMP policy action was likely applied?

A.Allow
B.Quarantine
C.Detect
D.Block
AnswerD

Block prevents the file from executing, stopping ransomware.

Why this answer

When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

Exam trap

Cisco often tests the distinction between 'Detect' and 'Block' actions, where candidates mistakenly think 'Detect' can stop an attack, but it only generates alerts without preventing execution.

How to eliminate wrong answers

Option A is wrong because 'Allow' would permit the file to execute, which contradicts the scenario where the ransomware was successfully blocked. Option B is wrong because 'Quarantine' is not a standalone AMP policy action; it is a consequence of the 'Block' action, where the file is moved to quarantine after being blocked. Option C is wrong because 'Detect' only logs and alerts on the file without preventing its execution, which would not stop a ransomware attack.

Practice this question →
23
Multi-Selecthard

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Select 3 answers
A.Cisco Prime Infrastructure
B.Cisco DNA Center
C.Group Policy Software Installation (MSI)
D.SCCM/Configuration Manager
E.Manual installation using the installer executable
AnswersC, D, E

Valid method via AD GPO.

Why this answer

Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Exam trap

Cisco often tests the distinction between network management tools (Prime Infrastructure, DNA Center) and endpoint deployment tools (Group Policy, SCCM, manual installation), expecting candidates to recognize that AMP for Endpoints is an endpoint security product deployed via standard Windows software distribution methods, not via Cisco's network infrastructure platforms.

Practice this question →
24
MCQmedium

A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?

A.Enable 'Send alerts for malicious files' in the AMP policy
B.Configure Syslog forwarding for all events
C.Enable 'Exploit Prevention' in block mode
D.Set the connector to 'Analyze' mode
AnswerA

This setting triggers alerts when a file is determined malicious by cloud sandbox.

Why this answer

The 'Send alerts for malicious files' setting in the AMP for Endpoints policy directly controls whether the connector sends a real-time alert to the management console when a file is determined to be malicious by the cloud sandbox (e.g., Threat Grid). This ensures immediate notification without relying on periodic polling or batch reporting.

Exam trap

Cisco often tests the distinction between 'Analyze' mode (which enables file submission to the cloud) and the separate alerting toggle, leading candidates to mistakenly think that enabling analysis automatically generates alerts for malicious verdicts.

How to eliminate wrong answers

Option B is wrong because Syslog forwarding sends all event logs to an external server, but it does not provide immediate notification within the AMP console; it is a logging mechanism, not an alerting trigger for sandbox verdicts. Option C is wrong because 'Exploit Prevention' in block mode is a protection feature that blocks exploit techniques at runtime, not a notification setting for cloud sandbox analysis results. Option D is wrong because setting the connector to 'Analyze' mode causes it to send files to the cloud for analysis but does not automatically enable immediate alerts for malicious verdicts; alerting is a separate policy toggle.

Practice this question →
25
MCQmedium

A security analyst sees multiple AMP events for 'Trojan.Generic.37283212' on several endpoints. After updating the AMP signatures, the detection still occurs. What is the best next step to reduce false positives?

A.Wait for the next signature update that might remove the detection.
B.Add the file SHA256 hash to the Custom Whitelist in the AMP policy.
C.Disable the signature for Trojan.Generic in the AMP policy.
D.Reinstall the AMP connector on the affected endpoints.
AnswerB

Whitelisting the specific file hash prevents future false positives while retaining protection.

Why this answer

Adding the file SHA256 hash to the Custom Whitelist in the AMP policy explicitly tells the AMP cloud to ignore that specific file, preventing false positives without disabling broader protections. Since the detection persists after signature updates, the file is likely a legitimate application that is being incorrectly flagged by the generic heuristic signature 'Trojan.Generic.37283212'. Whitelisting the exact hash ensures that only this file is exempted, maintaining security for other threats.

Exam trap

Cisco often tests the distinction between disabling a broad signature (which is too aggressive) and using a precise hash-based whitelist (which is the correct, surgical approach to handle false positives).

How to eliminate wrong answers

Option A is wrong because waiting for a future signature update is passive and does not address the immediate false positive; the detection may not be removed if the file is still considered suspicious by the heuristic engine. Option C is wrong because disabling the entire 'Trojan.Generic' signature would remove detection for all files matching that broad category, potentially allowing real trojans to go undetected. Option D is wrong because reinstalling the AMP connector does not change the detection logic or the signature database; the false positive would still occur after reinstallation.

Practice this question →
26
MCQhard

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

A.Submit the file to Cisco TALOS for reanalysis.
B.Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.
C.Disable AMP detection for that file type globally.
D.Change the AMP policy from 'Detect' to 'Audit' for the endpoint.
AnswerB

Custom exceptions override global dispositions, preventing future false positives without affecting other protections.

Why this answer

The recommended action to prevent a known false positive from being flagged again is to add the file's SHA-256 hash to the custom detection list with an 'Allow' or 'Uncategorized' disposition. This overrides the local or cloud-based verdict for that specific file, ensuring AMP for Endpoints treats it as clean without affecting global detection policies.

Exam trap

Cisco often tests the distinction between global policy changes (like disabling detection or switching to audit mode) and targeted hash-based overrides, expecting candidates to recognize that the most precise and secure fix is to add the specific file hash to a custom allow list.

How to eliminate wrong answers

Option A is wrong because submitting the file to TALOS for reanalysis is appropriate for a potential new malware variant, not for a confirmed false positive that has already been analyzed; TALOS reanalysis would not change the local override needed. Option C is wrong because disabling AMP detection for an entire file type globally would create a massive security gap, allowing all files of that type to bypass inspection, which is an extreme and unnecessary measure. Option D is wrong because changing the AMP policy from 'Detect' to 'Audit' for the endpoint would stop blocking all malware on that endpoint, not just the single false positive, and is not a targeted solution.

Practice this question →
27
Multi-Selectmedium

Which THREE of the following are recommended best practices for configuring Cisco AMP for Endpoints to minimize false positives while maintaining strong detection?

Select 3 answers
A.Set scan level to maximum for all file types
B.Enable file reputation scanning with cloud lookups
C.Use application blocking with a whitelist of approved software
D.Disable exploit prevention to reduce false positives
E.Configure exclusions for directories where trusted software is installed
AnswersB, C, E

File reputation scanning leverages cloud intelligence to classify files, reducing false positives from known good files.

Why this answer

Options B, C, and E are correct. Option B (File reputation scanning with cloud lookups) validates files against cloud intelligence, allowing known good files to reduce false positives. Option C (Application blocking with a whitelist of approved software) ensures only trusted applications run, minimizing false alerts.

Option E (Exclusions for directories where trusted software is installed) prevents scanning of benign files, lowering false positives while maintaining detection for unknowns. Option A is incorrect because setting scan level to maximum for all file types increases false positives without significant detection gain. Option D is incorrect because disabling exploit prevention weakens security and is not recommended.

Practice this question →
28
Drag & Dropmedium

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

IKE policy defines Phase 1 parameters, then pre-shared key is set, interesting traffic is defined via ACL, crypto map binds Phase 2 parameters, and it is applied to the interface.

Practice this question →
29
MCQmedium

A security engineer notices that several endpoints in the HR department have been infected with ransomware despite having Cisco AMP for Endpoints deployed. The AMP policy is set to 'Detect' for all file types. What is the most likely reason the ransomware was not blocked?

A.The endpoints had process exclusions that allowed the ransomware process.
B.The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.
C.The AMP cloud was unreachable during the infection attempt.
D.The file was too large for cloud analysis and AMP timed out.
AnswerB

The 'Detect' mode only generates alerts without taking preventive action.

Why this answer

Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.

Exam trap

Cisco often tests the distinction between 'Detect' and 'Block' actions in AMP policies, as candidates may assume that any detection capability automatically prevents execution, but 'Detect' is purely alerting without enforcement.

How to eliminate wrong answers

Option A is wrong because process exclusions in AMP are used to bypass scanning for legitimate processes, but the question states the ransomware was not blocked due to the policy setting, not due to an exclusion list. Option C is wrong because while cloud connectivity issues can affect retrospective analysis and file reputation lookups, AMP for Endpoints uses local TETRA (Traps Engine for Threat Recognition and Analysis) and Spero engine to block known malware even without cloud access; the 'Detect' policy would still allow execution regardless of cloud reachability. Option D is wrong because file size limits for cloud analysis (typically 8 MB for full upload) would cause AMP to fall back to local analysis or allow the file if it cannot be analyzed, but the core issue remains the policy action being set to 'Detect' rather than 'Block'.

Practice this question →
30
MCQeasy

A company uses Cisco Umbrella to block malicious domains. An endpoint user reports that they cannot access a legitimate business website. The website resolves to a domain that is not on any block list. What is the most likely cause?

A.The domain is listed in a custom Destination List with 'Block' action.
B.The domain is part of a content category that is blocked in the Umbrella policy.
C.The Umbrella policy has Application Settings enabled for 'Web Browsing' with block action.
D.The Umbrella roaming client is using an invalid API token.
AnswerB

Umbrella's content category filtering can block entire categories of websites, even if the domain is not individually listed.

Why this answer

Cisco Umbrella enforces security policies based on content categories, not just individual domains. Even if a domain is not explicitly blocked, it may belong to a content category (e.g., 'Newly Seen Domains', 'Pornography', 'Hacking') that has been set to 'Block' in the Umbrella policy. This is a common cause of legitimate sites being blocked, as Umbrella evaluates the domain against all applicable categories before allowing access.

Exam trap

Cisco often tests the distinction between explicit block lists (Destination Lists) and policy-based category blocking, leading candidates to assume that only explicitly listed domains can be blocked, when in fact content categories are a primary enforcement mechanism.

How to eliminate wrong answers

Option A is wrong because if the domain were in a custom Destination List with 'Block' action, it would be explicitly listed and easily identified; the question states the domain is not on any block list, ruling this out. Option C is wrong because Application Settings for 'Web Browsing' with block action would block the entire web browsing application (e.g., Chrome, Edge) from making any HTTP/HTTPS requests, not selectively block a specific domain; this would prevent all web access, not just one site. Option D is wrong because an invalid API token would cause the Umbrella roaming client to fail to connect to the cloud service entirely, resulting in no policy enforcement (allow all or block all depending on fail-open/fail-closed settings), not a selective block of a single domain.

Practice this question →
31
Multi-Selectmedium

Which TWO of the following are capabilities of Cisco Orbital?

Select 2 answers
A.Real-time file reputation checking
B.Running live queries across all endpoints
C.Scheduled forensic data collection tasks
D.Pre-execution sandboxing of unknown files
E.Automated endpoint isolation via ISE
AnswersB, C

Orbital allows queries in real-time across managed endpoints.

Why this answer

Cisco Orbital is a cloud-based endpoint query and response tool that uses the osquery framework to allow security teams to run live SQL-like queries across all endpoints in real time. It also supports scheduled forensic data collection tasks, enabling continuous monitoring and historical analysis of endpoint state without requiring persistent agents or heavy infrastructure.

Exam trap

Cisco often tests the distinction between Orbital's query and data collection capabilities versus AMP's prevention and reputation features, leading candidates to confuse Orbital with AMP's file analysis or sandboxing functions.

Practice this question →
32
MCQhard

A global enterprise with over 20,000 endpoints has been using Cisco AMP for Endpoints for two years. They recently migrated to a new SIEM and want to forward AMP events in near real-time. The security operations team notices that the SIEM is receiving duplicate events for the same file execution, causing alert fatigue. The AMP console shows that the 'Send to Syslog' action is enabled on two different policies, and both policies are applied to the same groups of endpoints. The team also uses the AMP APIs to pull data. The network engineer wants to eliminate duplicate events without losing any critical alerts. Which course of action should the engineer take?

A.Disable the AMP API to stop duplicates from multiple data sources.
B.Increase the event detection interval to reduce the number of events generated.
C.Remove the 'Send to Syslog' action from one of the two policies.
D.Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.
AnswerD

Eliminates duplicate policy application.

Why this answer

Duplicate events occur because the same set of endpoints is covered by two different policies both with the 'Send to Syslog' action enabled. By reviewing the group hierarchy and ensuring each endpoint is assigned to a single policy that includes the syslog action, you eliminate duplicates while still forwarding all events. Option A (disable API) does not affect syslog duplicates; the API is a separate data source.

Option B (increase detection interval) would not deduplicate events; it only changes the rate of detection. Option C (remove syslog action from one policy) might still cause duplicates if the other policy still applies to the same endpoints, and it could also affect other security settings in that policy. The proper approach is to maintain a clean policy assignment hierarchy.

Practice this question →
33
Multi-Selectmedium

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Select 2 answers
A.A locally installed SQL database for event storage.
B.A proxy server configured in the connector settings.
C.Outbound HTTPS access to the AMP cloud backend servers.
D.A valid registration token obtained from the AMP console.
E.An inbound firewall rule allowing connections from the AMP cloud.
AnswersC, D

The connector communicates with the cloud over HTTPS (port 443).

Why this answer

The AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Exam trap

Cisco often tests the misconception that inbound firewall rules are needed for cloud-based security products, but AMP for Endpoints uses a purely outbound model, so candidates mistakenly select option E thinking the cloud must 'push' data to the endpoint.

Practice this question →
34
MCQhard

A security analyst is investigating an alert from Cisco Secure Endpoint indicating that an endpoint has been infected with ransomware. The analyst wants to determine the initial infection vector. Which feature of Cisco Secure Endpoint should the analyst use to trace the chain of events leading to the infection?

A.Orbital Advanced Search
B.TETRA traffic analysis
C.Windows Event Viewer integration
D.Device Flow Correlation
AnswerA

Orbital Advanced Search provides retrospective analysis to trace the attack chain.

Why this answer

Orbital Advanced Search is the correct feature because it provides deep forensic visibility into endpoint activity, allowing the analyst to perform advanced queries across files, processes, registry keys, and network connections. This enables tracing the chain of events—such as a malicious email attachment, exploit, or drive-by download—that led to the ransomware infection, by correlating timestamps and process parent-child relationships.

Exam trap

Cisco often tests the distinction between network-level analysis (TETRA, Device Flow Correlation) and endpoint-level forensic investigation (Orbital), leading candidates to confuse traffic analysis with host-based event chain reconstruction.

How to eliminate wrong answers

Option B is wrong because TETRA traffic analysis is a network-based traffic analysis tool used for detecting anomalies in network flows, not for tracing endpoint-level event chains or initial infection vectors. Option C is wrong because Windows Event Viewer integration is a basic log collection method that lacks the advanced querying, cross-system correlation, and forensic depth needed to reconstruct a multi-step attack chain within Cisco Secure Endpoint. Option D is wrong because Device Flow Correlation focuses on correlating network flows between devices to identify lateral movement or C2 communication, not on tracing the initial infection vector on a single endpoint.

Practice this question →
35
Multi-Selectmedium

Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?

Select 3 answers
A.Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.
B.Deploy the AMP connector to all endpoints, including servers and desktops.
C.Create separate groups for different operating systems and applications to apply tailored policies.
D.Start with 'Audit' or 'Detect' mode to baseline and adjust before enforcing blocks.
E.Set the default policy action to 'Block' for all file types to maximize security from day one.
AnswersB, C, D

Comprehensive coverage is key for endpoint protection.

Why this answer

Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.

Exam trap

Cisco often tests the misconception that aggressive blocking (e.g., blocking all 'Unknown' files or setting 'Block' as the default action) is a best practice, when in reality, a phased approach starting with 'Audit' or 'Detect' mode is recommended to avoid breaking production systems and to fine-tune policies based on actual traffic patterns.

Practice this question →
36
MCQeasy

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

A.Cisco Umbrella
B.Cisco Stealthwatch
C.Cisco Firepower Management Center
D.Cisco ISE
AnswerA

Umbrella provides cloud-delivered threat intelligence and can block malicious file downloads from anywhere.

Why this answer

Cisco Umbrella is the correct answer because it provides cloud-delivered threat intelligence that can be integrated with existing endpoint protection platforms (EPPs) to block malicious file downloads regardless of the user's location. Umbrella uses DNS-layer security and cloud-based threat feeds to enforce policies on endpoints even when they are off the corporate network, making it ideal for location-agnostic protection.

Exam trap

Cisco often tests the distinction between on-premises security appliances (like Firepower) and cloud-delivered security services (like Umbrella), and the trap here is that candidates may assume Firepower Management Center can provide cloud threat intelligence to endpoints, when in fact it only manages on-premises firewalls and does not extend protection to endpoints off-network.

How to eliminate wrong answers

Option B (Cisco Stealthwatch) is wrong because it focuses on network traffic analysis and behavioral analytics using NetFlow/IPFIX data, not on cloud-delivered threat intelligence for endpoint file downloads. Option C (Cisco Firepower Management Center) is wrong because it is an on-premises management console for Firepower NGFW and NGIPS appliances, requiring traffic to be routed through the firewall for inspection, and does not provide cloud-delivered intelligence directly to endpoints. Option D (Cisco ISE) is wrong because it is a policy-based network access control (NAC) and identity management platform, not a cloud-delivered threat intelligence service for blocking malicious file downloads on endpoints.

Practice this question →
37
MCQmedium

Refer to the exhibit. A file with SHA256 hash 'a1b2c3d4e5f6...' is detected on an endpoint. The threat grid returns a score of 90 for this file. What action is taken by AMP?

A.Allow (because threat score 90 is not specifically matched in reputation).
B.Block (because the custom detection rule has action 'block').
C.Quarantine (because score 90 falls between 80 and 100).
D.No action (because the file is in the whitelist).
AnswerB

Custom detections are applied first; the file matches and is blocked.

Why this answer

The exhibit shows a custom detection rule configured with an action of 'block'. In Cisco AMP, custom detection rules take precedence over reputation scores or threat grid analysis. When a file matches a custom SHA256 hash rule, AMP applies the configured action (block) regardless of the threat score, which in this case is 90.

Exam trap

Cisco often tests the precedence of custom detection rules over reputation scores, leading candidates to mistakenly apply the threat grid score logic (e.g., quarantine for high scores) instead of recognizing that the custom rule's action is definitive.

How to eliminate wrong answers

Option A is wrong because AMP does not 'allow' files based on a threat score of 90 not being specifically matched; the custom detection rule overrides any reputation-based logic, and a score of 90 indicates high risk, not a reason to allow. Option C is wrong because quarantine is not automatically triggered by a score between 80 and 100; AMP uses threat grid scores for analysis, but the action is determined by the custom detection rule, not a score range. Option D is wrong because the file is not in the whitelist; the exhibit shows a custom detection rule with a block action, and whitelisting would require an explicit allow rule, which is absent.

Practice this question →
38
Multi-Selectmedium

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Select 2 answers
A.Exploit Prevention
B.Malware Analytics
C.Application Control
D.Lockdown Mode
E.File Reputation
AnswersC, D

Application Control allows whitelisting approved software.

Why this answer

Application Control (C) is correct because it allows administrators to define a whitelist of approved software, blocking all other executables from running on endpoints. Lockdown Mode (D) is correct because it enforces a strict policy where only pre-approved applications can execute, effectively preventing any unapproved software from running. Together, these features provide comprehensive control over executable files in a large enterprise environment.

Exam trap

Cisco often tests the distinction between 'blocking malicious files' (File Reputation) and 'blocking unapproved applications' (Application Control/Lockdown Mode), leading candidates to confuse threat-based blocking with policy-based whitelisting.

Practice this question →
39
MCQmedium

A security team is designing an endpoint protection strategy for a mix of Windows and macOS endpoints. They want to use Cisco AMP for Endpoints with centralized management. Which deployment approach minimizes administrative overhead?

A.Deploy an on-premises AMP Console for each operating system.
B.Install a Windows Server as a management point and deploy connectors via SCCM.
C.Use group policies to define different policies for Windows and macOS.
D.Use the AMP cloud console to manage a single policy that applies to both platforms with os-specific exclusions.
AnswerD

The cloud console supports multi-platform policy with per-OS rules, minimizing overhead.

Why this answer

Cisco AMP for Endpoints offers a cloud-based console that provides centralized management for both Windows and macOS endpoints from a single pane of glass. This eliminates the need for on-premises infrastructure or separate management tools, and a single policy can be applied across platforms with OS-specific exclusions to handle differences in file paths and processes, thereby minimizing administrative overhead.

Exam trap

The trap here is that candidates often assume different operating systems require separate management consoles or policies, but Cisco AMP for Endpoints' cloud console supports a single policy with OS-specific exclusions, which is the most efficient approach for minimizing administrative overhead.

How to eliminate wrong answers

Option A is wrong because deploying separate on-premises AMP Consoles for each operating system increases administrative overhead by requiring dedicated hardware, maintenance, and separate management interfaces, contradicting the goal of centralized management. Option B is wrong because installing a Windows Server as a management point and deploying connectors via SCCM adds unnecessary complexity and administrative overhead, as SCCM is not required for AMP for Endpoints deployment and the cloud console already provides centralized management without additional infrastructure. Option C is wrong because using group policies to define different policies for Windows and macOS is not a native AMP for Endpoints deployment method; group policies are a Windows-centric feature and do not apply to macOS, and this approach would require separate policy management, increasing overhead rather than minimizing it.

Practice this question →
40
MCQeasy

An organization wants to enforce that specific sensitive files are never executed on endpoints. Which AMP for Endpoints feature is most appropriate?

A.Outbreak Control (file extension blocking)
B.Simple or advanced custom detections (Application Control)
C.Exclusion lists
D.Behavioral analysis and engine protection
AnswerB

Custom detections allow blocking specific files via SHA-256 hashes or paths.

Why this answer

Simple or advanced custom detections (Application Control) allow administrators to create hash-based or path-based rules that explicitly block execution of specific files. This directly meets the requirement to prevent sensitive files from ever running on endpoints, as Application Control enforces allow/block policies at the file execution level, not just at the network or signature level.

Exam trap

Cisco often tests the distinction between blocking file execution (Application Control) and blocking file transfer or access (Outbreak Control), leading candidates to mistakenly choose Outbreak Control when the question specifically says 'never executed.'

How to eliminate wrong answers

Option A is wrong because Outbreak Control (file extension blocking) only blocks files based on their extension (e.g., .exe, .pdf), not specific sensitive files; it cannot target a particular file by hash or path. Option C is wrong because Exclusion lists are used to exempt files or processes from scanning, not to block execution; they would actually allow sensitive files to run. Option D is wrong because Behavioral analysis and engine protection detects and blocks malicious behavior after execution begins, but it does not prevent a specific sensitive file from being executed in the first place.

Practice this question →
41
MCQeasy

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

A.Disable file analysis for known good file types to improve performance.
B.Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.
C.Set the policy to 'Block' immediately to maximize protection.
D.Disable AMP's network firewall to reduce complexity.
AnswerB

Audit/Detect modes allow identification of false positives and tuning before enforcement.

Why this answer

Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.

Exam trap

Cisco often tests the misconception that maximum protection (Block mode) should be applied immediately, but the trap is that they want you to recognize the operational necessity of a phased deployment (Audit/Detect first) to avoid business disruption and ensure policy accuracy.

How to eliminate wrong answers

Option A is wrong because disabling file analysis for known good file types reduces visibility and can allow malware that masquerades as a trusted file to bypass detection; AMP's file analysis engine uses multiple techniques (e.g., static analysis, machine learning) that should remain enabled for all files. Option C is wrong because immediately setting the policy to 'Block' can cause business disruption by quarantining legitimate files or applications that are not yet recognized as safe, leading to false positives and operational issues. Option D is wrong because disabling AMP's network firewall reduces the endpoint's defense-in-depth capabilities; the firewall component provides an additional layer of protection by blocking malicious network connections and should be configured, not disabled, to reduce complexity.

Practice this question →
42
MCQhard

A security analyst observes that one endpoint is generating Alerts of type 'Trojan' in Cisco AMP, but other identical endpoints on the same software version show no issues. After verifying that the signature versions are consistent, what is the most likely cause of the discrepancy?

A.A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature
B.The AMP connector is misconfigured and is generating false alerts
C.The endpoint's network traffic is being intercepted by a proxy causing AMP to misidentify it
D.The endpoint has an outdated operating system patch
AnswerA

AMP's behavioral analysis might flag a legitimate application if it behaves like malware. Other endpoints may not have that app.

Why this answer

In Cisco AMP, a single endpoint generating 'Trojan' alerts while identical peers remain clean, with consistent signature versions, strongly indicates a false positive caused by a legitimate application exhibiting behavior that matches a Trojan signature. AMP uses behavioral analysis and signature-based detection; if a benign application performs actions (e.g., file writes, registry modifications, or network connections) that resemble known malware patterns, it can trigger an alert. Since other endpoints with the same software and signatures are unaffected, the issue is localized to that specific endpoint's unique application or configuration, not a global misconfiguration or signature issue.

Exam trap

Cisco often tests the concept that false positives are a common cause of isolated alerts, tempting candidates to choose a misconfiguration or network issue, but the key is that identical endpoints with the same signatures rule out global problems, leaving a local behavioral anomaly as the most likely cause.

How to eliminate wrong answers

Option B is wrong because a misconfigured AMP connector would typically cause widespread or consistent false alerts across multiple endpoints, not a single isolated case, and the question states other identical endpoints show no issues. Option C is wrong because proxy interception would affect all endpoints behind the same proxy, not just one, and AMP analyzes file and process behavior locally, not just network traffic, so proxy interception is unlikely to cause a localized Trojan false positive. Option D is wrong because an outdated OS patch would likely cause broader security issues or missing protections, but it does not directly cause AMP to generate false positive Trojan alerts; signature-based detection relies on file/behavior patterns, not OS patch level.

Practice this question →
43
MCQeasy

A company with 5000 endpoints uses Cisco Secure Endpoint (AMP) and Cisco ISE. Users report that legitimate software installations are being quarantined, causing delays. The security team receives many alerts for file executions. The AMP policy is set to "High Security" with "Block Unknown" enabled. Network traffic is monitored by Cisco Stealthwatch. The team wants to reduce operational overhead while maintaining security. What should they do?

A.Disable "Block Unknown" and rely solely on Stealthwatch for threat detection
B.Create an AMP exclusion for software installation directories and enable "File Reputation" with "Cloud Lookups"
C.Change AMP policy to "Medium Security" and enable "Application Blocking with Allow List"
D.Disable AMP and use only ISE for endpoint posture checks
AnswerB

Exclusions reduce false positives for trusted paths, while file reputation with cloud lookups maintains detection for unknown files, balancing security and overhead.

Why this answer

Creating an AMP exclusion for software installation directories reduces false positives by preventing scanning of known legitimate installations. Enabling File Reputation with Cloud Lookups maintains detection by checking unknown files against cloud intelligence, thus not sacrificing security. Option A is too broad; disabling 'Block Unknown' would allow unknown threats to execute.

Option C lowers the security level to 'Medium Security' which may miss some threats and 'Application Blocking with Allow List' is not directly related to the issue. Option D removes endpoint protection entirely, increasing risk.

Practice this question →
44
MCQhard

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

A.The cloud analysis result was delayed due to high traffic.
B.The local analysis engine was disabled, so the file was not analyzed locally.
C.The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.
D.The endpoint did not have connectivity to the AMP cloud at the time of execution.
AnswerC

Unknown files may be allowed until the cloud verdict returns; if the action is not 'Block', execution occurs.

Why this answer

C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.

Exam trap

Cisco often tests the distinction between local and cloud analysis phases, and the trap here is that candidates assume 'Unknown' means the file was not analyzed at all, when in fact it means the local analysis could not determine maliciousness and the policy action for unknown files is the deciding factor.

How to eliminate wrong answers

Option A is wrong because while high traffic can delay cloud analysis, the question states the disposition changed after cloud analysis, not that the analysis itself was delayed; the initial 'Unknown' disposition is a local verdict, not a delayed cloud result. Option B is wrong because if the local analysis engine were disabled, AMP would not have any disposition for the file, and the logs would not show an 'Unknown' disposition — the local engine is what produces the 'Unknown' verdict when it cannot definitively classify the file. Option D is wrong because if the endpoint lacked cloud connectivity at execution, the file would remain 'Unknown' indefinitely and never change to 'Malicious' after cloud analysis; the fact that the disposition later changed proves cloud connectivity was available.

Practice this question →
45
Multi-Selecteasy

Which TWO are required to successfully deploy Cisco AMP for Endpoints in a Windows domain environment with Group Policy?

Select 2 answers
A.Install the AMP connector on each endpoint
B.Configure the firewall to block outbound HTTPS traffic
C.Install the AMP connector on a domain controller
D.Assign an AMP policy to the connector via Group Policy
E.Ensure all endpoints are joined to the domain
AnswersA, D

The connector must be present to enforce policies.

Why this answer

The AMP for Endpoints connector is the agent software that must be installed on each endpoint to provide malware detection, file trajectory, and retrospective security analysis. Without the connector, the endpoint cannot communicate with the AMP cloud or enforce any security policies, making deployment non-functional.

Exam trap

Cisco often tests the misconception that Group Policy can both install software and assign policies, but in reality, Group Policy only assigns the AMP policy via registry settings, while the connector installation must be handled separately through startup scripts, SCCM, or manual methods.

Practice this question →
46
MCQhard

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

A.The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.
B.The AMP policy has file reputation disabled, so all files are allowed.
C.The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.
D.The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.
AnswerC

Local analysis can override cloud reputation if configured and the file passes local heuristics.

Why this answer

Cisco AMP for Endpoints uses a layered approach: cloud-based file reputation (Threat Grid) provides a score, but if the policy has Local Analysis enabled, the endpoint's local engine can override the cloud verdict. In this scenario, the local analysis determined the file was safe, so the file was allowed despite the high cloud score of 90. This explains the discrepancy between the Threat Grid score and the AMP connector's 'Allow' action.

Exam trap

Cisco often tests the concept that AMP's Local Analysis can override cloud-based reputation scores, leading to a file being allowed despite a high malicious score in Threat Grid, which candidates mistakenly attribute to misconfigured file blocking or reputation settings.

How to eliminate wrong answers

Option A is wrong because the 'File Blocking' setting, when set to 'Off', disables file blocking entirely, but it does not ignore cloud scores; it simply does not enforce blocking based on any score. Option B is wrong because disabling file reputation in the AMP policy would prevent the endpoint from querying the cloud for reputation, but it would not cause a file with a high cloud score to be allowed; instead, the file would be handled by other mechanisms like local analysis or simple allow/block rules. Option D is wrong because AMP events are near real-time; delayed event ingestion would not cause the console to show 'Allow' for a blocked file—it would either show no event or a delayed 'Blocked' event, not an incorrect 'Allow' status.

Practice this question →
47
MCQhard

A security architect is designing a solution to detect and block ransomware using Cisco AMP. The requirement is that when a file executes and attempts to encrypt files in a monitored directory, the event must be captured and the process terminated immediately. Which AMP feature set should be used?

A.Exploit Prevention with Behavioral Protection enabled.
B.Application Control with a block list of known ransomware binaries.
C.Vulnerability Assessment with real-time patching.
D.Device Flow Correlation (DFC) with advanced malware analysis.
AnswerA

This feature set detects ransomware behaviors and can automatically terminate the process.

Why this answer

Cisco AMP's Exploit Prevention with Behavioral Protection is designed to monitor file behavior in real time. When a file executes and attempts to encrypt files in a monitored directory, Behavioral Protection detects the anomalous activity (e.g., mass file modifications) and can immediately terminate the process, meeting the requirement to capture and block the ransomware event.

Exam trap

Cisco often tests the distinction between signature-based controls (like Application Control) and behavioral-based controls (like Exploit Prevention with Behavioral Protection), leading candidates to mistakenly choose a static block list approach for dynamic ransomware detection.

How to eliminate wrong answers

Option B is wrong because Application Control with a block list of known ransomware binaries relies on static signatures or hashes, which cannot detect unknown or zero-day ransomware that has not been previously identified. Option C is wrong because Vulnerability Assessment with real-time patching focuses on identifying and remediating software vulnerabilities, not on detecting or blocking malicious file behavior like encryption attempts. Option D is wrong because Device Flow Correlation (DFC) with advanced malware analysis is used for network traffic analysis and correlation, not for endpoint behavioral monitoring or process termination.

Practice this question →
48
MCQeasy

Refer to the exhibit. What happened to the file 'crack.exe'?

A.The file was allowed because it was detected as malicious.
B.The file was blocked from executing.
C.The file was detected but no action was taken.
D.The file was quarantined to a secure folder.
AnswerB

The log explicitly states 'Blocked by policy'.

Why this answer

The exhibit shows that Cisco AMP for Endpoints detected 'crack.exe' as malicious and applied the 'BLOCK' action, which prevents the file from executing on the endpoint. This is indicated by the 'BLOCK' disposition in the event details, meaning the file was blocked before it could run. Option B is correct because the file was blocked from executing based on the detection and policy configured in AMP.

Exam trap

Cisco often tests the distinction between 'BLOCK' and 'QUARANTINE' actions in AMP, where candidates may confuse blocking execution with quarantining the file, but the exhibit explicitly shows the 'BLOCK' action, not 'QUARANTINE'.

How to eliminate wrong answers

Option A is wrong because the file was not allowed; it was blocked, and 'allowed because it was detected as malicious' is contradictory since malicious files are typically blocked, not allowed. Option C is wrong because the exhibit shows an action was taken ('BLOCK'), not that no action was taken; 'detected but no action' would correspond to a 'MONITOR' or 'ALERT' disposition. Option D is wrong because the file was blocked from executing, not quarantined to a secure folder; quarantine involves moving the file to a safe location, which is a different action than blocking execution.

Practice this question →
49
MCQhard

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

A.The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.
B.Windows Defender Real-time Protection is interfering with the AMP connector.
C.The Exploit Prevention module is blocking the cloud lookup process.
D.The AMP cloud license has expired for the organization.
AnswerA

If the endpoint was offline during file download, the initial cloud lookup is skipped, and the file is allowed.

Why this answer

Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Exam trap

Cisco often tests the nuance that 'Use cloud lookup' requires real-time connectivity at the exact moment of file creation, not just general internet access, and candidates mistakenly assume that a later online state will retroactively detect the file.

How to eliminate wrong answers

Option B is wrong because Windows Defender Real-time Protection does not interfere with the AMP connector; both can coexist, and Cisco Secure Endpoint is designed to operate alongside other antivirus products without conflict. Option C is wrong because the Exploit Prevention module does not block cloud lookup processes; it monitors for exploit techniques like code injection or heap spray, not network-based reputation queries. Option D is wrong because if the AMP cloud license had expired, the connector would typically show a licensing error or fail to communicate entirely, but the scenario states the endpoint can reach the AMP cloud, implying connectivity and licensing are functional.

Practice this question →
50
MCQhard

An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?

A.The AMP connector is not configured with a proxy when needed.
B.The endpoint's AMP connector has local analysis disabled, preventing hash matching.
C.The AMP signature database on that endpoint is outdated.
D.The AMP policy is set to 'Block' instead of 'Detect'.
AnswerB

Local analysis allows matching known bad hashes without cloud lookup; if disabled, detection may rely solely on cloud.

Why this answer

When AMP for Endpoints fails to detect a file that is known to be malicious (based on its hash) and other endpoints have already detected it, the most likely cause is that local analysis (also known as local scanning or local hash matching) is disabled on the failing endpoint. AMP for Endpoints uses a combination of cloud-based lookups and local analysis. If local analysis is disabled, the endpoint cannot perform hash-based detection against its local cache or signature database, and it must rely entirely on cloud connectivity.

If the cloud lookup is delayed or the endpoint is offline, detection fails. Option B directly addresses this scenario.

Exam trap

Cisco often tests the misconception that AMP for Endpoints relies on a traditional signature database (like a .dat file) that can become outdated, when in fact the primary detection mechanism is cloud-based with a local cache that is not a full signature database.

How to eliminate wrong answers

Option A is wrong because a proxy misconfiguration would prevent cloud connectivity, but the question states the file hash is available and other endpoints detected it, implying cloud connectivity is not the issue; moreover, local analysis would still work if enabled. Option C is wrong because AMP for Endpoints does not rely on a locally stored signature database like traditional antivirus; it uses a lightweight local cache and cloud lookups, so an 'outdated signature database' is not a relevant concept for hash-based detection. Option D is wrong because setting the policy to 'Block' instead of 'Detect' would still trigger detection (and then block), not cause a failure to detect; the detection engine runs regardless of the action taken.

Practice this question →
51
MCQhard

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

A.The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.
B.The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.
C.The file was determined to be malicious by the cloud after the first detection.
D.The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.
AnswerD

TETRA events are triggered when an unknown file is executed; the connector quarantines the file and sends it to the cloud for analysis.

Why this answer

The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.

Exam trap

Cisco often tests the misconception that a TETRA event is a separate detection type rather than a correlation mechanism, leading candidates to confuse it with a cloud communication error or a re-execution trigger.

How to eliminate wrong answers

Option A is wrong because a TETRA event is not an error generated by a communication failure; it is a trajectory event that correlates multiple related detections. Option B is wrong because the file was not previously blocked (the first event shows 'Action: Allowed'), and TETRA events do not trigger simply from executing a file from a different location. Option C is wrong because if the cloud had determined the file to be malicious after the first detection, the third event would show a 'Malicious' disposition, not 'Unknown'.

Practice this question →
52
MCQmedium

An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?

A.Cisco Stealthwatch with NetFlow
B.Cisco Web Security Appliance
C.Cisco Firepower Next-Gen Firewall
D.Cisco ISE with pxGrid
AnswerD

pxGrid enables AMP to send isolation commands to ISE, which then changes the endpoint's network access.

Why this answer

Cisco ISE with pxGrid (Platform Exchange Grid) enables automated policy-based responses by allowing Cisco AMP for Endpoints to share threat intelligence with ISE. When AMP detects a high-severity malware, it triggers a pxGrid event that instructs ISE to dynamically quarantine the host by applying a security group access control list (SGACL) or a CoA (Change of Authorization) to block network access. This integration is specifically designed for context sharing and automated remediation across Cisco security products.

Exam trap

Cisco often tests the misconception that a firewall (like Firepower NGFW) is the primary tool for host isolation, but the trap here is that endpoint isolation requires network access control (NAC) integration via ISE and pxGrid, not just traffic filtering at the perimeter.

How to eliminate wrong answers

Option A is wrong because Cisco Stealthwatch with NetFlow provides network visibility and behavioral analytics but does not have a native mechanism to receive AMP malware detection alerts and enforce host isolation; it focuses on flow-based anomaly detection, not endpoint policy enforcement. Option B is wrong because Cisco Web Security Appliance (WSA) is a proxy for web traffic filtering and cannot directly isolate a host from the entire network based on AMP endpoint detections; it lacks the policy enforcement point for network access control. Option C is wrong because Cisco Firepower Next-Gen Firewall (NGFW) can block traffic based on threat intelligence but requires integration via Firepower Management Center (FMC) or pxGrid to receive AMP events; however, the question asks for the integration that enables automated response, and ISE with pxGrid is the direct, purpose-built integration for host isolation, whereas Firepower NGFW alone does not perform endpoint quarantine actions like RADIUS CoA or NAC.

Practice this question →
53
MCQeasy

Which component of Cisco AMP for Endpoints is responsible for preventing the execution of known malware by checking files against a continuously updated cloud database before they run?

A.Exploit Prevention
B.Application Control
C.File Reputation
D.Orbital
AnswerC

File Reputation checks files against Talos intelligence to block known malware.

Why this answer

File Reputation is the correct answer because it is the Cisco AMP for Endpoints component that queries a continuously updated cloud database (the AMP Threat Grid) to check the reputation of a file before it executes. If the file is known malware, execution is blocked immediately, preventing the threat from running. This pre-execution check relies on the file's SHA-256 hash and cloud-based reputation scoring.

Exam trap

Cisco often tests the distinction between pre-execution cloud-based reputation checks (File Reputation) and runtime behavioral protection (Exploit Prevention), so candidates mistakenly choose Exploit Prevention because they associate it with blocking malware execution, but it does not use cloud lookups.

How to eliminate wrong answers

Option A is wrong because Exploit Prevention focuses on blocking exploit techniques (e.g., buffer overflows, heap sprays) at runtime using memory protection and behavioral analysis, not on checking file reputation against a cloud database. Option B is wrong because Application Control enforces policies on which applications are allowed to run based on path, publisher, or hash, but it does not perform cloud-based reputation lookups; it uses local whitelist/blacklist rules. Option D is wrong because Orbital is a remote investigation and response tool that enables live queries and forensic data collection from endpoints, not a pre-execution file reputation check.

Practice this question →
54
MCQmedium

A security analyst is investigating a compromised endpoint that is part of a botnet. The endpoint is running Cisco Secure Endpoint with TETRA. The analyst notices that the endpoint is communicating with a command-and-control (C2) server over HTTPS. Which TETRA feature would be most effective in detecting this traffic?

A.URL filtering against known malicious URL databases
B.SSL/TLS decryption and inspection
C.File reputation and cloud lookup
D.Protocol analysis with deep packet inspection
AnswerB

TETRA can decrypt SSL traffic if configured, allowing inspection of C2 communication.

Why this answer

TETRA (Telemetry and Threat Response Analytics) on Cisco Secure Endpoint can detect C2 traffic over HTTPS by performing SSL/TLS decryption and inspection. This allows the agent to examine encrypted payloads for malicious patterns, such as beaconing or command-and-control protocol artifacts, which would otherwise be hidden in the encrypted tunnel.

Exam trap

The trap here is that candidates often choose deep packet inspection (DPI) without realizing that DPI cannot inspect encrypted HTTPS traffic without SSL/TLS decryption, making it ineffective for detecting C2 communication over HTTPS.

How to eliminate wrong answers

Option A is wrong because URL filtering against known malicious URL databases relies on static reputation lists and cannot detect C2 traffic using dynamically generated or previously unknown domains, nor can it inspect encrypted content. Option C is wrong because file reputation and cloud lookup analyze file hashes and behaviors, not network traffic patterns like HTTPS C2 communication. Option D is wrong because protocol analysis with deep packet inspection (DPI) cannot inspect encrypted HTTPS payloads without first decrypting the SSL/TLS session, making it ineffective against encrypted C2 traffic.

Practice this question →
55
MCQmedium

An incident responder notices that an AMP connector on a critical server has stopped sending 'IP to Application' mapping events after a software update. Which step should be taken to restore this telemetry?

A.Enable the 'Network' component in the AMP connector settings and restart the service.
B.Uninstall and reinstall the AMP connector with default settings.
C.Update the AMP policy on the connector to force a configuration reload.
D.Restart the AMP connector service on the server.
AnswerA

The 'IP to Application' mapping is part of the 'Network' component, which can be disabled during update.

Why this answer

The AMP connector's 'IP to Application' mapping telemetry is provided by the Network component, which is separate from the File and Malware components. After a software update, this component may be disabled by default or reset. Enabling the Network component in the AMP connector settings and restarting the service restores the telemetry stream without requiring a full reinstall or policy reload.

Exam trap

Cisco often tests the misconception that restarting a service or reinstalling the connector will restore all functionality, when in fact specific components like Network must be explicitly re-enabled after an update.

How to eliminate wrong answers

Option B is wrong because uninstalling and reinstalling with default settings would not guarantee the Network component is enabled, and it introduces unnecessary risk and downtime. Option C is wrong because updating the AMP policy on the connector forces a configuration reload but does not specifically enable the Network component; the policy may not control per-component settings at the connector level. Option D is wrong because restarting the AMP connector service alone does not enable the disabled Network component; it only restarts the existing configuration, which still lacks the Network telemetry.

Practice this question →
56
Multi-Selecthard

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Select 3 answers
A.Real-time blocking of malicious processes at the endpoint
B.Device Trajectory to visualize the timeline of events on an endpoint
C.Centralized search across endpoint, network, and email telemetry
D.Automatic deployment of software patches to endpoints
E.Casebook creation to document investigation steps and share with team
AnswersB, C, E

Device Trajectory is a key feature in AMP/CTR for reconstructing events.

Why this answer

Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

Exam trap

The trap here is that candidates confuse the capabilities of the endpoint protection agent (e.g., real-time blocking or patching) with the investigative and orchestration functions of Cisco Threat Response, which is a separate cloud service that aggregates telemetry but does not perform active prevention or remediation actions.

Practice this question →
57
MCQmedium

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

A.Restart the Cisco AMP for Endpoints connector service on the affected endpoints.
B.Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.
C.Change the update policy interval from 4 hours to 1 hour to force more frequent checks.
D.Check if the firewall is blocking the signature update port 443 for those specific endpoints.
AnswerB

Clearing the update cache forces a fresh download of signature updates, resolving stuck updates.

Why this answer

The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Exam trap

The trap here is that candidates assume connectivity issues (firewall) or service restarts are the fix, but Cisco specifically tests the knowledge that a corrupted local signature cache requires clearing the cache, not restarting the service or changing the update interval.

How to eliminate wrong answers

Option A is wrong because restarting the AMP connector service only restarts the process; it does not address a corrupted or stale local signature cache, which is the root cause of the 'Out of Date' status. Option C is wrong because changing the update interval from 4 hours to 1 hour does not fix the underlying issue—if the cache is corrupted, more frequent checks will still fail to download valid signatures. Option D is wrong because the network team already confirmed that endpoints can reach the private cloud on TCP port 443, so a firewall block is not the problem.

Practice this question →
58
MCQeasy

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

A.Cisco Stealthwatch
B.Cisco Identity Services Engine (ISE)
C.Cisco Firepower NGFW
D.Cisco Secure Endpoint (AMP for Endpoints)
AnswerD

Cisco Secure Endpoint provides cloud-based file reputation and analysis.

Why this answer

Cisco Secure Endpoint (formerly AMP for Endpoints) is the correct answer because it provides cloud-based file reputation and analysis through its Advanced Malware Protection (AMP) cloud. This service uses global threat intelligence and machine learning to analyze file behavior, assign reputation scores, and block or quarantine malicious files on endpoints in real time.

Exam trap

Cisco often tests the distinction between network-based file inspection (Firepower NGFW with AMP for Networks) and endpoint-based file reputation (Secure Endpoint), so candidates mistakenly choose Firepower NGFW because they associate 'file reputation' with the firewall's AMP feature, not realizing the question specifies 'endpoints' and 'cloud-based file reputation and analysis' for endpoint protection.

How to eliminate wrong answers

Option A is wrong because Cisco Stealthwatch is a network visibility and security analytics tool that uses NetFlow/IPFIX data for behavioral analysis and threat detection, not a cloud-based file reputation service for endpoints. Option B is wrong because Cisco Identity Services Engine (ISE) is a policy-based network access control (NAC) and identity management platform that enforces access policies via 802.1X, MAC Authentication Bypass (MAB), and posture assessment, but it does not perform file reputation analysis. Option C is wrong because Cisco Firepower NGFW is a next-generation firewall that provides network-based intrusion prevention (IPS), URL filtering, and AMP for Networks (file reputation on the network perimeter), not endpoint-level file reputation and analysis.

Practice this question →
59
MCQeasy

A company wants to ensure that only authorized applications can run on endpoints. Which feature of Cisco AMP for Endpoints should be used to create a whitelist of allowed applications?

A.Application Control
B.Exploit Prevention
C.Orbital Advanced Search
D.File Reputation
AnswerA

Application Control allows whitelisting of approved applications and blocks unauthorized ones.

Why this answer

Application Control in Cisco AMP for Endpoints allows administrators to define a whitelist of approved applications by specifying SHA-256 hashes, file paths, or publisher certificates. This feature enforces a 'deny-by-default' policy, blocking any executable not explicitly allowed, which directly meets the requirement to ensure only authorized applications can run on endpoints.

Exam trap

Cisco often tests the distinction between 'Application Control' (whitelisting/blacklisting based on static criteria) and 'File Reputation' (cloud-based dynamic analysis), leading candidates to mistakenly choose File Reputation because they associate 'reputation' with trust, but it does not enforce a strict allowlist.

How to eliminate wrong answers

Option B (Exploit Prevention) is wrong because it focuses on detecting and blocking exploit techniques (e.g., buffer overflows, privilege escalation) rather than controlling which applications are allowed to execute. Option C (Orbital Advanced Search) is wrong because it is a remote investigation and threat-hunting tool that queries endpoint data for forensic analysis, not a mechanism to enforce application whitelisting. Option D (File Reputation) is wrong because it uses cloud-based reputation scores (e.g., known good, known bad, unknown) to assess files, but it does not create a static whitelist; it relies on dynamic analysis and can allow unknown files if not explicitly blocked.

Practice this question →
60
Drag & Dropmedium

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First enable AnyConnect image, then define IP pool, group policy, tunnel group, and apply to interface.

Practice this question →
61
MCQmedium

A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?

A.Configure the AMP connector to use a static IP address for the cloud.
B.Reboot the endpoint to force a policy download.
C.Verify that SNMP is enabled on the endpoint.
D.Verify that the endpoint can resolve the AMP cloud hostname using DNS.
AnswerD

The connector must resolve the cloud hostname for HTTPS connections.

Why this answer

The AMP connector must resolve the AMP cloud hostname (e.g., `amp.cisco.com`) via DNS to establish the HTTPS connection. Even if outbound HTTPS is allowed, a DNS resolution failure would prevent the endpoint from reaching the cloud, causing the 'Out-of-Date' status. Verifying DNS ensures the endpoint can translate the hostname to an IP address, which is a prerequisite for policy updates.

Exam trap

Cisco often tests the misconception that outbound HTTPS access alone guarantees connectivity, when in fact DNS resolution is a separate prerequisite that must be verified, especially in environments with internal DNS servers or strict DNS filtering policies.

How to eliminate wrong answers

Option A is wrong because the AMP connector does not require a static IP address for the cloud; it uses dynamic DNS resolution and the cloud's IP addresses can change. Option B is wrong because rebooting the endpoint may temporarily force a connection attempt but does not address the underlying cause (e.g., DNS failure or connectivity issues) and is not a recommended troubleshooting step for policy updates. Option C is wrong because SNMP is used for network monitoring and management, not for AMP policy updates or cloud communication; the AMP connector uses HTTPS (TCP/443) and does not rely on SNMP.

Practice this question →
62
MCQmedium

A SOC analyst notices that after deploying Cisco AMP for Endpoints, some legitimate business software is being blocked by the Exploit Prevention engine. What is the recommended action to allow this software while maintaining maximum security?

A.Disable Exploit Prevention entirely on affected endpoints
B.Create an application exception in Exploit Prevention policy
C.Add the software's executable hash to the file exclusion list
D.Set Exploit Prevention to 'Audit' mode
AnswerB

Allows the specific application while maintaining protection for others.

Why this answer

Cisco AMP for Endpoints' Exploit Prevention engine uses behavioral analysis to block suspicious activities, and legitimate software may trigger these heuristics. Creating an application exception in the Exploit Prevention policy allows the specific software to run without disabling the entire engine, preserving protection against other exploits. This targeted exception maintains maximum security by only exempting the known legitimate application from exploit detection rules.

Exam trap

Cisco often tests the distinction between file exclusions (for malware detection) and application exceptions (for Exploit Prevention), leading candidates to mistakenly choose the file exclusion list option.

How to eliminate wrong answers

Option A is wrong because disabling Exploit Prevention entirely removes protection against all exploit-based attacks on affected endpoints, significantly reducing security posture. Option C is wrong because file exclusion lists are used for file reputation and malware detection, not for Exploit Prevention behavioral rules; adding the executable hash does not bypass exploit heuristics. Option D is wrong because setting Exploit Prevention to 'Audit' mode only logs detections without blocking, which reduces security by allowing the exploit-like behavior to proceed unblocked on all applications, not just the legitimate one.

Practice this question →
63
MCQeasy

A financial company uses Cisco AMP for Endpoints to protect 500 Windows workstations. The security administrator notices that several endpoints in the accounting department are showing 'Out-of-Date' status for over a week. The administrator checks the AMP console and sees that the group policy for accounting has been modified to disable certain scanning features. The endpoints have Internet connectivity but are not updating their policy or receiving new definitions. The administrator suspects a misconfiguration. What should the administrator do first to resolve this issue?

A.Restart the AMP services on a few affected endpoints to force a policy update.
B.Verify that the endpoints can communicate with the AMP cloud by checking the connector's connectivity status.
C.Increase the policy polling interval from 60 minutes to 30 minutes.
D.Reinstall the AMP connector on all affected endpoints.
AnswerB

This identifies if the issue is network-related.

Why this answer

The most common cause of 'Out-of-Date' endpoints is a communication issue. Checking the AMP connector's connection status (e.g., via the connector GUI) can reveal if the endpoint can reach the cloud. Option A (restarting services) might temporarily fix but does not identify the root cause.

Option C (increasing polling interval) does not help if there is a connectivity obstacle. Option D (reinstalling the connector) is drastic and should be a last resort.

Practice this question →
64
Multi-Selecthard

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Select 3 answers
A.Configure custom whitelist exclusions for trusted applications
B.Use group-based policies to apply different rules to different endpoint populations
C.Enable all exploit prevention rules regardless of environment
D.Set file reputation to block only files with 'Malicious' disposition
E.Disable file reputation to reduce cloud queries
AnswersA, B, D

Whitelisting reduces false positives.

Why this answer

Configuring custom whitelist exclusions for trusted applications prevents Cisco AMP for Endpoints from flagging legitimate software as malicious, which directly reduces false positives. This is done by adding file hashes, paths, or certificate signers to the exclusion list, ensuring that known safe executables are not subjected to further analysis or blocked.

Exam trap

Cisco often tests the misconception that enabling all exploit prevention rules maximizes security, but the trap here is that doing so ignores environmental context and leads to false positives, while disabling file reputation is a dangerous overreaction that sacrifices protection for performance.

Practice this question →
65
MCQeasy

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

A.Exploit prevention with ransomware rollback
B.File reputation scanning
C.Device flow telemetry
D.Application blocking via policy
AnswerA

Exploit prevention uses behavioral analysis to detect ransomware and can roll back file changes automatically.

Why this answer

Cisco's endpoint protection includes a behavioral analysis engine that monitors for ransomware-like activities (e.g., mass file encryption, rapid file modifications). Upon detection, the feature automatically triggers a rollback, restoring affected files to their pre-encryption state using Volume Shadow Copy Service (VSS) snapshots or similar mechanisms, effectively reversing the ransomware's changes.

Exam trap

Cisco often tests the distinction between prevention (blocking before execution) and remediation (rolling back after execution), so candidates may confuse file reputation or application blocking with the rollback capability, missing that only behavioral analysis with rollback addresses post-infection recovery.

How to eliminate wrong answers

Option B is wrong because file reputation scanning relies on static or cloud-based hash lookups (e.g., Talos intelligence) to block known malware, but it does not perform behavioral analysis or rollback changes. Option C is wrong because device flow telemetry (e.g., NetFlow or IPFIX) provides network traffic visibility and anomaly detection, but it is not an endpoint security feature and cannot reverse file modifications. Option D is wrong because application blocking via policy uses allow/deny lists or path-based rules to prevent execution, but it lacks behavioral detection and the ability to undo changes after an attack.

Practice this question →
66
MCQhard

An organization deploys AMP for Endpoints with the Orbital module to perform advanced endpoint telemetry. The team wants to create a query that retrieves all running processes with a network connection to an external IP address. Which Orbital query language syntax is correct?

A.SELECT * FROM all_processes WHERE ip = 'external'
B.SELECT * FROM all_processes WHERE listening = 'true'
C.SELECT * FROM processes WHERE network_connection = 'true'
D.SELECT * FROM all_processes WHERE remote_ip IN (SELECT ip FROM connections WHERE direction = 'OUT')
AnswerD

This correctly uses the 'all_processes' table with a subquery on 'connections' to filter processes with outgoing remote connections.

Why this answer

The Orbital query language uses SQL-like syntax, and the correct way to retrieve all running processes with a network connection to an external IP address is to join the `all_processes` table with the `connections` table, filtering for outbound connections (`direction = 'OUT'`) and checking that the `remote_ip` is not a private IP (though the query as written uses a subquery to get IPs from outbound connections). This directly matches the requirement of processes with external network connections.

Exam trap

Cisco often tests the distinction between listening (inbound) and outbound connections, and candidates mistakenly choose options that filter for listening processes or use non-existent columns/table names, assuming a simpler boolean flag exists instead of understanding the relational join required.

How to eliminate wrong answers

Option A is wrong because `ip = 'external'` is not valid Orbital syntax; there is no literal string 'external' for IP addresses, and the `all_processes` table does not have an `ip` column—it uses `remote_ip` and `local_ip`. Option B is wrong because `listening = 'true'` retrieves processes that are listening for inbound connections, not processes with outbound network connections to external IPs. Option C is wrong because `processes` is not a valid table name in Orbital (the correct table is `all_processes`), and `network_connection = 'true'` is not a valid column or filter; Orbital does not have a boolean column indicating whether a process has a network connection.

Practice this question →
67
MCQhard

During a threat hunt, you need to retrieve forensic data from a remote endpoint that is currently not communicating with the AMP cloud. Which Cisco tool enables you to perform an on-demand scan and collect telemetry from that endpoint even when it is offline?

A.Cisco Threat Response
B.Cisco Stealthwatch
C.Cisco Orbital
D.Cisco AMP Console
AnswerC

Orbital provides advanced endpoint querying and can execute on-demand or scheduled tasks even if endpoint is offline.

Why this answer

Cisco Orbital is the correct answer because it is a remote endpoint investigation and response tool that can execute live queries, on-demand scans, and collect forensic telemetry from endpoints even when they are not currently communicating with the AMP cloud. It uses a lightweight agent that caches queries locally and returns results once connectivity is restored, enabling offline data collection.

Exam trap

Cisco often tests the distinction between cloud-dependent tools (like AMP Console) and those with offline capabilities (like Orbital), so the trap here is assuming that the AMP Console can perform on-demand scans on non-communicating endpoints when it actually requires active cloud connectivity for any interactive action.

How to eliminate wrong answers

Option A is wrong because Cisco Threat Response (CTR) is a threat intelligence and orchestration platform that aggregates alerts from multiple sources but does not directly perform on-demand scans or collect telemetry from offline endpoints. Option B is wrong because Cisco Stealthwatch is a network traffic analysis tool that monitors NetFlow/IPFIX data for behavioral anomalies, not endpoint-level forensic collection. Option D is wrong because the AMP Console is the management interface for Cisco AMP that provides historical and real-time endpoint data, but it cannot initiate on-demand scans or retrieve telemetry from endpoints that are currently offline and not communicating with the cloud.

Practice this question →
68
MCQeasy

An organization is deploying Cisco Secure Endpoint (AMP) for the first time in a Windows environment. The security team wants to ensure that any file executed from a USB drive is automatically scanned and blocked if malicious. Which policy feature should be enabled to achieve this?

A.Enable File Reputation to check files against the cloud.
B.Enable Exploit Prevention to block malicious code execution.
C.Configure Quarantine actions for all file events.
D.Enable Removable Media Scan in the policy.
AnswerD

This feature automatically scans files on removable media when accessed.

Why this answer

Cisco Secure Endpoint (AMP) includes a dedicated 'Removable Media Scan' policy feature that automatically scans files executed from USB drives and other removable media. When enabled, this feature triggers a scan of any file launched from a removable device, and if the file is determined to be malicious based on local or cloud reputation, it can be blocked or quarantined before execution completes.

Exam trap

Cisco often tests the distinction between a general security feature (like File Reputation or Exploit Prevention) and a policy-specific trigger (like Removable Media Scan) that activates scanning on a particular event, leading candidates to select a feature that sounds relevant but does not specifically address the USB execution scenario.

How to eliminate wrong answers

Option A is wrong because File Reputation checks files against the cloud for known good or bad hashes, but it is a general scanning mechanism that does not specifically target removable media; it must be combined with a policy trigger like Removable Media Scan to enforce scanning on USB execution. Option B is wrong because Exploit Prevention is designed to block exploit techniques (e.g., buffer overflows, code injection) at runtime, not to scan or block files based on their content or reputation when executed from a USB drive. Option C is wrong because configuring Quarantine actions for all file events would quarantine files based on detection events, but without enabling Removable Media Scan, the policy does not automatically trigger scanning of files executed from USB drives; quarantine is an action, not a trigger.

Practice this question →
69
MCQhard

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

A.The AMP cloud servers are blocking the connector's IP address.
B.The proxy server address is incorrect in the connector configuration.
C.The proxy requires authentication, and the AMP connector has no credentials configured.
D.The connector has no network connectivity to the internet.
AnswerC

The 407 error explicitly indicates proxy authentication failure.

Why this answer

The AMP connector is configured to use a proxy server, but the proxy requires authentication. Without credentials configured in the connector, the proxy will reject the HTTP CONNECT request (RFC 7231), preventing the connector from establishing the TLS tunnel to the AMP cloud. This is a common scenario when an organization uses an authenticated forward proxy, and the connector's proxy settings lack the username/password fields.

Exam trap

Cisco often tests the distinction between proxy reachability and proxy authentication—candidates see the connector can reach the proxy and incorrectly assume the proxy address is correct, overlooking the missing credentials that cause the 407 error.

How to eliminate wrong answers

Option A is wrong because AMP cloud servers do not block specific connector IP addresses; they authenticate via API keys or certificates, not source IP. Option B is wrong because if the proxy server address were incorrect, the connector would fail to reach any proxy at all, but the exhibit shows the connector is reaching the proxy (as indicated by the proxy error response). Option D is wrong because the connector clearly has network connectivity to the internet—it successfully communicates with the proxy server, which is an internet-facing device.

Practice this question →
70
MCQhard

An organization is using Cisco Umbrella alongside Cisco AMP for Endpoints. A user reports that they cannot access a legitimate file-sharing website. However, the site is not categorized as malicious by Umbrella. What is the most likely reason for the block?

A.Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it
B.The website's domain is in a custom block list
C.The endpoint's firewall is blocking the connection
D.The user is behind a proxy that is not configured with Umbrella
AnswerA

Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it. This feature inspects file downloads based on real-time threat intelligence, even if the website itself is not categorized as malicious by Cisco Umbrella.

Why this answer

Cisco AMP for Endpoints includes an Intelligent Proxy feature that can inspect and block file downloads based on real-time threat intelligence, even if the website itself is not categorized as malicious by Cisco Umbrella. In this scenario, the user can access the site but the file download is blocked, which aligns with AMP's Intelligent Proxy intercepting the download and determining it to be potentially malicious.

Exam trap

Cisco often tests the distinction between Umbrella's DNS-layer security (which blocks based on domain category) and AMP's Intelligent Proxy (which blocks based on file reputation), leading candidates to incorrectly assume that a domain-level block is the cause when the issue is actually file-level.

How to eliminate wrong answers

Option B is wrong because a custom block list would block the entire domain, not just the file download, and the user reports they cannot access the site, but the site is not categorized as malicious by Umbrella, so a custom block list is unlikely. Option C is wrong because an endpoint firewall blocking the connection would prevent any access to the site entirely, not just the file download, and the user specifically reports inability to access the site, not a firewall alert. Option D is wrong because if the user were behind a proxy not configured with Umbrella, Umbrella would not be able to enforce any policy, and the block would not occur; the issue is specifically about a block that is happening, which requires Umbrella or AMP to be in the path.

Practice this question →
71
MCQhard

A company with 5,000 endpoints is using Cisco Secure Endpoint. The security team receives an alert that a specific file (SHA256: 8f4a...b2c) has been detected as malware on 10 endpoints. The file has been quarantined on those endpoints. The team wants to ensure that no other endpoints in the organization have this file. Which feature should be used to locate the file across all endpoints?

A.The Policy editor with file blacklist
B.Orbital Advanced Search
C.TETRA traffic analysis
D.The AMP Dashboard with event filters
AnswerB

Orbital can search across all endpoints for a specific file hash.

Why this answer

Orbital Advanced Search is the correct feature because it provides a powerful, query-based search capability across all endpoints managed by Cisco Secure Endpoint. It allows the security team to search for specific file hashes (like SHA256: 8f4a...b2c) across the entire endpoint fleet, identifying any endpoint that has the file present, regardless of whether it has been quarantined or not. This is the only option that enables proactive, organization-wide file discovery beyond simple alert-based or policy-driven actions.

Exam trap

Cisco often tests the distinction between reactive alert-based tools (like the AMP Dashboard) and proactive search capabilities (like Orbital), and the trap here is that candidates assume the dashboard's event filters can locate files across all endpoints, when in fact they only show events that have already been logged.

How to eliminate wrong answers

Option A is wrong because the Policy editor with file blacklist is a preventive control that blocks files from executing or being written, but it does not provide a search or discovery capability to locate files already present on endpoints. Option C is wrong because TETRA traffic analysis is a network-based detection and response tool that analyzes encrypted traffic patterns, not a file search mechanism for endpoints. Option D is wrong because the AMP Dashboard with event filters shows historical events and alerts, but it cannot perform a proactive, query-based search for a specific file hash across all endpoints; it only displays events that have already triggered alerts.

Practice this question →
72
Multi-Selecthard

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Select 2 answers
A.Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.
B.Enable SSL decryption in the AMP connector policy.
C.Register the Threat Grid appliance in the AMP cloud as a private analysis provider.
D.Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.
E.Install the Cisco Threat Grid Connector on each endpoint.
AnswersA, C

The connector policy must specify the Threat Grid appliance as the target for file analysis.

Why this answer

The AMP for Endpoints connector policy must be configured to submit files to the on-premises Threat Grid appliance. This directs the endpoint connector to send suspicious files to the local Threat Grid for dynamic analysis instead of the public cloud. Option C is correct because the Threat Grid appliance must be registered in the AMP cloud as a private analysis provider, which creates a secure tunnel (using TLS) between the AMP cloud and the on-premises appliance, enabling file submission and result retrieval.

Exam trap

Cisco often tests the misconception that inbound firewall rules are needed for on-premises appliances, when in fact the Threat Grid appliance initiates outbound connections to the AMP cloud, making option D a common distractor.

Practice this question →
73
Multi-Selecthard

Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?

Select 2 answers
A.Malicious DNS queries
B.Phishing email headers
C.Fileless attack techniques (e.g., PowerShell injection)
D.File-based malware (via file reputation and analysis)
E.Anomalous network traffic patterns
AnswersC, D

AMP behavioral analysis detects fileless attacks by monitoring process behavior.

Why this answer

Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.

Exam trap

Cisco often tests the distinction between endpoint-based detection (AMP) and network-based detection (e.g., Umbrella, Stealthwatch), leading candidates to incorrectly select network-related IOCs like malicious DNS queries or anomalous traffic patterns.

Practice this question →
74
MCQhard

Refer to the exhibit. An engineer notices that a malicious file disguised as 'app.exe' in the FinanceApp folder (SHA-256 unknown to AMP) was blocked. However, another unknown executable in the same folder was also blocked, causing a false positive. What should the engineer change in the policy to allow only the legitimate 'app.exe' while still blocking unknown executables?

A.Remove the file exclusion for the FinanceApp folder entirely.
B.Remove the process exclusion for app.exe.
C.Change the action for unknown files from 'block' to 'detect'.
D.Change the file exclusion path to the exact full path of app.exe instead of a wildcard.
AnswerD

A specific path exclusion for app.exe will allow it while still blocking other unknown executables in the folder.

Why this answer

The current policy uses a wildcard file exclusion for the entire FinanceApp folder, which causes the AMP engine to skip scanning all files within that folder, including unknown executables. By changing the exclusion to the exact full path of the legitimate 'app.exe', only that specific file is excluded from scanning, while other unknown executables in the folder remain subject to the 'block' action for unknown files. This allows the known good file to execute without being blocked, while still blocking other unknown files that may be malicious.

Exam trap

Cisco often tests the distinction between file exclusions (which bypass scanning) and process exclusions (which bypass behavioral analysis), and the trap here is that candidates confuse the two or assume that removing the folder exclusion entirely is the solution, rather than narrowing the exclusion to a specific file path.

How to eliminate wrong answers

Option A is wrong because removing the file exclusion entirely would cause the legitimate 'app.exe' to be scanned and potentially blocked if its SHA-256 is unknown to AMP, which does not solve the false positive issue. Option B is wrong because removing the process exclusion for app.exe is irrelevant; the issue is with file scanning, not process behavior, and process exclusions control behavior-based detection, not file reputation. Option C is wrong because changing the action for unknown files from 'block' to 'detect' would allow all unknown files, including the malicious one, to execute and only generate an alert, which defeats the security requirement to block the malicious file.

Practice this question →
75
MCQmedium

A security engineer is troubleshooting an issue where Cisco AMP for Endpoints is not detecting a known malware sample on a Windows endpoint. The endpoint is running Windows 10 with the latest AMP connector installed and is connected to the corporate network. The malware sample was downloaded from a trusted source for testing. Which configuration is most likely causing the lack of detection?

A.The connector is configured to operate in offline mode.
B.The file reputation scanning is disabled.
C.Custom detections are not configured for the malware.
D.Real-time scanning is disabled for the download directory.
AnswerA

In offline mode, the connector cannot perform cloud lookups for file hashes, so known malware may not be detected.

Why this answer

When Cisco AMP for Endpoints is in offline mode, the connector cannot communicate with the cloud-based threat intelligence and reputation servers. This prevents it from performing file reputation lookups and retrieving the latest malware signatures, so even known malware samples will not be detected. The connector relies on cloud lookups for real-time detection of new or known threats, and offline mode disables this critical function.

Exam trap

Cisco often tests the misconception that disabling real-time scanning or file reputation scanning is the primary cause of missed detections, when in fact the connector's inability to communicate with the cloud (offline mode) is the most direct and common reason for failing to detect known malware.

How to eliminate wrong answers

Option B is wrong because file reputation scanning is a core function that is enabled by default and cannot be disabled; the connector always performs reputation checks when online. Option C is wrong because custom detections are user-defined rules for specific indicators, but the question states the malware is a known sample that should be detected by built-in signatures, not custom rules. Option D is wrong because real-time scanning is a separate feature that monitors file system activity; even if disabled for a specific directory, the connector would still detect the malware via on-access or scheduled scans unless the entire connector is offline.

Practice this question →
Page 1 of 2 · 78 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Endpoint Protection and Detection questions.

Start 20-question session