350-701 Endpoint Protection and Detection Practice Question
Exhibit
Refer to the exhibit. ``` ! Cisco Secure Endpoint Policy Snippet ! File Reputation Settings file-reputation cloud-lookup enable file-reputation local-cache enable file-reputation timeout 5 ! Exploit Prevention Settings exploit-prevention enable exploit-prevention level aggressive ! Malware Protection Settings malware-protection enable malware-protection scan-on-execution enable malware-protection scan-on-write enable ```
Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?
⚠ Common exam trap
Cisco often tests the misconception that offline endpoints will block or quarantine unknown files, when in fact the default behavior is to allow them based on local cache and policy settings for unknown dispositions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file will be allowed because local cache will store an unknown disposition.
When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file will be held until the endpoint comes online and a cloud lookup completes.
Why it's wrong here
The policy does not hold files; timeout is 5 seconds.
- ✗
The file will be quarantined due to the aggressive exploit prevention level.
Why it's wrong here
Exploit Prevention does not affect file reputation.
- ✓
The file will be allowed because local cache will store an unknown disposition.
Why this is correct
Local cache stores unknown disposition; file is allowed until cloud lookup can be performed later.
- ✗
The file will be blocked immediately by scan-on-write.
Why it's wrong here
Scan-on-write triggers a scan, but if cloud is unavailable, unknown files are allowed.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.