How should I use these Endpoint Protection and Detection practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Endpoint Protection and Detection questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Endpoint Protection and Detection domain.

350-701 · topic practice

Endpoint Protection and Detection practice questions

Practise Cisco SCOR / CCNP Security Core 350-701 Endpoint Protection and Detection practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Endpoint Protection and Detection

Practice 10 questions Browse domain →

What the exam tests

What to know about Endpoint Protection and Detection

IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.

IPv6 address types and their scopes (link-local, global unicast, multicast, ULA).

SLAAC vs DHCPv6 vs stateful assignment.

Neighbor Discovery Protocol replacing ARP.

IPv6 routing differences and dual-stack coexistence.

Watch out for

Common Endpoint Protection and Detection exam traps

▸Link-local addresses are not routable beyond the local link.
▸SLAAC uses EUI-64 or random interface IDs — not a DHCP server.
▸NDP uses ICMPv6, not ARP.
▸An IPv6 prefix is /64 for most host subnets, not /24.

Practice set

Endpoint Protection and Detection questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Endpoint Protection and Detection explanation →

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

Trap 1: Disable the built-in firewall on the endpoints to allow full…

Disabling the firewall increases risk; TETRA works with firewall enabled.

Trap 2: Wait for the weekly threat report from Cisco Talos to identify the…

Waiting delays response; threat must be contained immediately.

Trap 3: Uninstall the Cisco Secure Endpoint connector and reinstall it with…

Uninstalling removes protection; reinstallation is not necessary.

Study all Endpoint Protection and Detection common traps →

A
Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.
Why wrong: Disabling the firewall increases risk; TETRA works with firewall enabled.
B
Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.
TETRA provides real-time traffic analysis; the console allows immediate visibility and isolation.
C
Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.
Why wrong: Waiting delays response; threat must be contained immediately.
D
Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.
Why wrong: Uninstalling removes protection; reinstallation is not necessary.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Endpoint Protection and Detection explanation →

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

Trap 1: Cisco Stealthwatch

Stealthwatch is for network traffic analytics, not endpoint protection.

Trap 2: Cisco Identity Services Engine (ISE)

ISE is for network access control, not file reputation.

Trap 3: Cisco Firepower NGFW

NGFW is a network-based firewall, not an endpoint solution.

Study all Endpoint Protection and Detection common traps →

A
Cisco Stealthwatch
Why wrong: Stealthwatch is for network traffic analytics, not endpoint protection.
B
Cisco Identity Services Engine (ISE)
Why wrong: ISE is for network access control, not file reputation.
C
Cisco Firepower NGFW
Why wrong: NGFW is a network-based firewall, not an endpoint solution.
D
Cisco Secure Endpoint (AMP for Endpoints)
Cisco Secure Endpoint provides cloud-based file reputation and analysis.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Endpoint Protection and Detection explanation →

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Trap 1: Windows Defender Real-time Protection is interfering with the AMP…

AMP works alongside Windows Defender without interference.

Trap 2: The Exploit Prevention module is blocking the cloud lookup process.

Exploit Prevention does not block cloud lookups.

Trap 3: The AMP cloud license has expired for the organization.

If license expired, all cloud lookups would fail, not just this one.

Study all Endpoint Protection and Detection common traps →

A
The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.
If the endpoint was offline during file download, the initial cloud lookup is skipped, and the file is allowed.
B
Windows Defender Real-time Protection is interfering with the AMP connector.
Why wrong: AMP works alongside Windows Defender without interference.
C
The Exploit Prevention module is blocking the cloud lookup process.
Why wrong: Exploit Prevention does not block cloud lookups.
D
The AMP cloud license has expired for the organization.
Why wrong: If license expired, all cloud lookups would fail, not just this one.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Endpoint Protection and Detection explanation →

A security analyst is investigating an alert from Cisco Secure Endpoint indicating that an endpoint has been infected with ransomware. The analyst wants to determine the initial infection vector. Which feature of Cisco Secure Endpoint should the analyst use to trace the chain of events leading to the infection?

Trap 1: TETRA traffic analysis

TETRA provides real-time network traffic analysis, not historical tracing.

Trap 2: Windows Event Viewer integration

Windows Event Viewer is not integrated into AMP.

Trap 3: Device Flow Correlation

This is not a feature of Cisco Secure Endpoint.

Study all Endpoint Protection and Detection common traps →

A
Orbital Advanced Search
Orbital Advanced Search provides retrospective analysis to trace the attack chain.
B
TETRA traffic analysis
Why wrong: TETRA provides real-time network traffic analysis, not historical tracing.
C
Windows Event Viewer integration
Why wrong: Windows Event Viewer is not integrated into AMP.
D
Device Flow Correlation
Why wrong: This is not a feature of Cisco Secure Endpoint.

Full breakdown with real-world context →

Question 5mediummulti select

Read the full Endpoint Protection and Detection explanation →

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Trap 1: File Reputation

File Reputation uses known signatures, not effective against zero-day.

Trap 2: Application Control

Application Control is for managing allowed applications, not zero-day protection.

Trap 3: Device Control

Device Control manages peripheral devices, not zero-day protection.

Study all Endpoint Protection and Detection common traps →

A
File Reputation
Why wrong: File Reputation uses known signatures, not effective against zero-day.
B
Exploit Prevention
Exploit Prevention protects against exploit techniques used by zero-day attacks.
C
Malware Analytics (sandboxing)
Sandboxing analyzes unknown files for malicious behavior.
D
Application Control
Why wrong: Application Control is for managing allowed applications, not zero-day protection.
E
Device Control
Why wrong: Device Control manages peripheral devices, not zero-day protection.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Endpoint Protection and Detection explanation →

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Trap 1: Exploit Prevention

Exploit Prevention is for exploit techniques, not application control.

Trap 2: Malware Analytics

Malware Analytics is for sandboxing, not application control.

Trap 3: File Reputation

File Reputation is for known malware, not application whitelisting.

Study all Endpoint Protection and Detection common traps →

A
Exploit Prevention
Why wrong: Exploit Prevention is for exploit techniques, not application control.
B
Malware Analytics
Why wrong: Malware Analytics is for sandboxing, not application control.
C
Application Control
Application Control allows whitelisting approved software.
D
Lockdown Mode
Lockdown Mode prevents execution of unapproved executables.
E
File Reputation
Why wrong: File Reputation is for known malware, not application whitelisting.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Endpoint Protection and Detection explanation →

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

Exhibit

Refer to the exhibit.

```
Cisco Secure Endpoint Connector Log
[2025-03-15 10:23:45] File scan initiated: C:\Users\jdoe\Downloads\invoice.pdf.exe
[2025-03-15 10:23:46] File reputation check: SHA256=2a3b...c4d5
[2025-03-15 10:23:46] Cloud lookup: result=UNKNOWN
[2025-03-15 10:23:47] File disposition: UNKNOWN
[2025-03-15 10:23:47] Local analysis: verdict=Malicious (score=85)
[2025-03-15 10:23:47] Action: Quarantine file
```

Trap 1: The file was blocked at execution time by Exploit Prevention.

The file was quarantined upon scan, not at execution.

Trap 2: The cloud reputation determined the file was malicious and…

Cloud result was UNKNOWN, not malicious.

Trap 3: The file was executed and then reverted by the retrospective engine.

No execution occurred; file was quarantined on scan.

Study all Endpoint Protection and Detection common traps →

A
The file was blocked at execution time by Exploit Prevention.
Why wrong: The file was quarantined upon scan, not at execution.
B
The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.
Log shows cloud result UNKNOWN, then local analysis verdict Malicious.
C
The cloud reputation determined the file was malicious and instructed the connector to quarantine.
Why wrong: Cloud result was UNKNOWN, not malicious.
D
The file was executed and then reverted by the retrospective engine.
Why wrong: No execution occurred; file was quarantined on scan.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Endpoint Protection and Detection explanation →

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Exhibit

Refer to the exhibit.

```
! Cisco Secure Endpoint Policy Snippet
! File Reputation Settings
file-reputation cloud-lookup enable
file-reputation local-cache enable
file-reputation timeout 5
! Exploit Prevention Settings
exploit-prevention enable
exploit-prevention level aggressive
! Malware Protection Settings
malware-protection enable
malware-protection scan-on-execution enable
malware-protection scan-on-write enable
```

Trap 1: The file will be held until the endpoint comes online and a cloud…

The policy does not hold files; timeout is 5 seconds.

Trap 2: The file will be quarantined due to the aggressive exploit…

Exploit Prevention does not affect file reputation.

Trap 3: The file will be blocked immediately by scan-on-write.

Scan-on-write triggers a scan, but if cloud is unavailable, unknown files are allowed.

Study all Endpoint Protection and Detection common traps →

A
The file will be held until the endpoint comes online and a cloud lookup completes.
Why wrong: The policy does not hold files; timeout is 5 seconds.
B
The file will be quarantined due to the aggressive exploit prevention level.
Why wrong: Exploit Prevention does not affect file reputation.
C
The file will be allowed because local cache will store an unknown disposition.
Local cache stores unknown disposition; file is allowed until cloud lookup can be performed later.
D
The file will be blocked immediately by scan-on-write.
Why wrong: Scan-on-write triggers a scan, but if cloud is unavailable, unknown files are allowed.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Endpoint Protection and Detection explanation →

A security analyst is investigating a compromised endpoint that is part of a botnet. The endpoint is running Cisco Secure Endpoint with TETRA. The analyst notices that the endpoint is communicating with a command-and-control (C2) server over HTTPS. Which TETRA feature would be most effective in detecting this traffic?

Trap 1: URL filtering against known malicious URL databases

URL filtering is not part of TETRA.

Trap 2: File reputation and cloud lookup

File reputation does not analyze network traffic.

Trap 3: Protocol analysis with deep packet inspection

DPI cannot inspect encrypted payload without decryption.

Study all Endpoint Protection and Detection common traps →

A
URL filtering against known malicious URL databases
Why wrong: URL filtering is not part of TETRA.
B
SSL/TLS decryption and inspection
TETRA can decrypt SSL traffic if configured, allowing inspection of C2 communication.
C
File reputation and cloud lookup
Why wrong: File reputation does not analyze network traffic.
D
Protocol analysis with deep packet inspection
Why wrong: DPI cannot inspect encrypted payload without decryption.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full Endpoint Protection and Detection explanation →

A company with 5,000 endpoints is using Cisco Secure Endpoint. The security team receives an alert that a specific file (SHA256: 8f4a...b2c) has been detected as malware on 10 endpoints. The file has been quarantined on those endpoints. The team wants to ensure that no other endpoints in the organization have this file. Which feature should be used to locate the file across all endpoints?

Trap 1: The Policy editor with file blacklist

Policy editor configures rules, but does not search for existing files.

Trap 2: TETRA traffic analysis

TETRA analyzes network traffic, not file presence on endpoints.

Trap 3: The AMP Dashboard with event filters

Dashboard shows events, but not a proactive search for a file across all endpoints.

Study all Endpoint Protection and Detection common traps →

A
The Policy editor with file blacklist
Why wrong: Policy editor configures rules, but does not search for existing files.
B
Orbital Advanced Search
Orbital can search across all endpoints for a specific file hash.
C
TETRA traffic analysis
Why wrong: TETRA analyzes network traffic, not file presence on endpoints.
D
The AMP Dashboard with event filters
Why wrong: Dashboard shows events, but not a proactive search for a file across all endpoints.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full Endpoint Protection and Detection explanation →

A security engineer is troubleshooting an issue where Cisco AMP for Endpoints is not detecting a known malware sample on a Windows endpoint. The endpoint is running Windows 10 with the latest AMP connector installed and is connected to the corporate network. The malware sample was downloaded from a trusted source for testing. Which configuration is most likely causing the lack of detection?

Trap 1: The file reputation scanning is disabled.

File reputation scanning is typically enabled by default; disabling it would affect detection, but the sample is known malware, so cloud lookup is more critical.

Trap 2: Custom detections are not configured for the malware.

Custom detections are for proprietary or unknown threats; known malware should be detected via cloud intelligence.

Trap 3: Real-time scanning is disabled for the download directory.

Real-time scanning would still detect the malware if cloud lookups were available; offline mode bypasses that.

Study all Endpoint Protection and Detection common traps →

A
The connector is configured to operate in offline mode.
In offline mode, the connector cannot perform cloud lookups for file hashes, so known malware may not be detected.
B
The file reputation scanning is disabled.
Why wrong: File reputation scanning is typically enabled by default; disabling it would affect detection, but the sample is known malware, so cloud lookup is more critical.
C
Custom detections are not configured for the malware.
Why wrong: Custom detections are for proprietary or unknown threats; known malware should be detected via cloud intelligence.
D
Real-time scanning is disabled for the download directory.
Why wrong: Real-time scanning would still detect the malware if cloud lookups were available; offline mode bypasses that.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Endpoint Protection and Detection explanation →

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Trap 1: File reputation scanning

File reputation checks file hashes against a known database but does not provide behavioral analysis or rollback.

Trap 2: Device flow telemetry

Device flow telemetry provides network visibility but not endpoint behavioral detection or rollback.

Trap 3: Application blocking via policy

Application blocking prevents execution but does not detect ransomware behavior or roll back changes.

Study all Endpoint Protection and Detection common traps →

A
Exploit prevention with ransomware rollback
Exploit prevention uses behavioral analysis to detect ransomware and can roll back file changes automatically.
B
File reputation scanning
Why wrong: File reputation checks file hashes against a known database but does not provide behavioral analysis or rollback.
C
Device flow telemetry
Why wrong: Device flow telemetry provides network visibility but not endpoint behavioral detection or rollback.
D
Application blocking via policy
Why wrong: Application blocking prevents execution but does not detect ransomware behavior or roll back changes.

Full breakdown with real-world context →

Question 13hardmulti select

Read the full Endpoint Protection and Detection explanation →

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Trap 1: Enable SSL decryption in the AMP connector policy.

SSL decryption is not a prerequisite for Threat Grid file analysis; it may be used for other purposes.

Trap 2: Ensure the firewall allows inbound traffic to the Threat Grid…

The firewall should allow outbound traffic from endpoints to the Threat Grid appliance, not inbound.

Trap 3: Install the Cisco Threat Grid Connector on each endpoint.

The Threat Grid Connector is a separate product; AMP connectors do not require it for file submission.

Study all Endpoint Protection and Detection common traps →

A
Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.
The connector policy must specify the Threat Grid appliance as the target for file analysis.
B
Enable SSL decryption in the AMP connector policy.
Why wrong: SSL decryption is not a prerequisite for Threat Grid file analysis; it may be used for other purposes.
C
Register the Threat Grid appliance in the AMP cloud as a private analysis provider.
The AMP cloud needs to know the Threat Grid appliance exists to route file analysis requests.
D
Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.
Why wrong: The firewall should allow outbound traffic from endpoints to the Threat Grid appliance, not inbound.
E
Install the Cisco Threat Grid Connector on each endpoint.
Why wrong: The Threat Grid Connector is a separate product; AMP connectors do not require it for file submission.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full NAT/PAT explanation →

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Exhibit

Refer to the exhibit.

Cisco AMP for Endpoints event log:

Event Type: Detection
Threat: W32.Ransomware
File Name: encrypt.exe
File Path: C:\Users\test\Downloads\encrypt.exe
Action: Blocked
Disposition: Malware
File Hash: a1b2c3d4e5f6...

Event Type: Detection
Threat: W32.Ransomware
File Name: encrypt.exe
File Path: C:\Users\test\AppData\Local\Temp\encrypt.exe
Action: Blocked
Disposition: Malware
File Hash: a1b2c3d4e5f6...

Event Type: TETRA Event
Threat: W32.Ransomware
File Name: encrypt.exe
File Path: C:\Users\test\AppData\Roaming\encrypt.exe
Action: Quarantine
Disposition: Unknown
File Hash: a1b2c3d4e5f6...

Trap 1: The AMP connector failed to communicate with the cloud and…

TETRA events are not error messages; they are part of the targeted execution analysis process.

Trap 2: The file was previously blocked, but the user executed it from a…

The file was blocked in two locations, but TETRA events occur when a file with unknown disposition is executed, not because of previous blocks.

Trap 3: The file was determined to be malicious by the cloud after the…

The disposition is 'Unknown' in the TETRA event, indicating the cloud has not yet classified it.

Study all Endpoint Protection and Detection common traps →

A
The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.
Why wrong: TETRA events are not error messages; they are part of the targeted execution analysis process.
B
The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.
Why wrong: The file was blocked in two locations, but TETRA events occur when a file with unknown disposition is executed, not because of previous blocks.
C
The file was determined to be malicious by the cloud after the first detection.
Why wrong: The disposition is 'Unknown' in the TETRA event, indicating the cloud has not yet classified it.
D
The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.
TETRA events are triggered when an unknown file is executed; the connector quarantines the file and sends it to the cloud for analysis.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full NAT/PAT explanation →

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

Trap 1: Restart the Cisco AMP for Endpoints connector service on the…

Restarting the service may not clear the update cache and could cause temporary loss of protection.

Trap 2: Change the update policy interval from 4 hours to 1 hour to force…

The issue is not the frequency but a stuck update; changing the interval does not resolve a corrupted cache.

Trap 3: Check if the firewall is blocking the signature update port 443 for…

The network team already confirmed connectivity on port 443, so firewall is not the issue.

Study all Endpoint Protection and Detection common traps →

A
Restart the Cisco AMP for Endpoints connector service on the affected endpoints.
Why wrong: Restarting the service may not clear the update cache and could cause temporary loss of protection.
B
Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.
Clearing the update cache forces a fresh download of signature updates, resolving stuck updates.
C
Change the update policy interval from 4 hours to 1 hour to force more frequent checks.
Why wrong: The issue is not the frequency but a stuck update; changing the interval does not resolve a corrupted cache.
D
Check if the firewall is blocking the signature update port 443 for those specific endpoints.
Why wrong: The network team already confirmed connectivity on port 443, so firewall is not the issue.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Endpoint Protection and Detection explanation →

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Trap 1: Use the default malware protection policy, which automatically…

Default policy blocks known malware but not all untrusted executables by path.

Trap 2: Configure an Exclusion for the Downloads folder and then use a…

Exclusions prevent scanning, not execution; they do not block execution.

Trap 3: Enable Simple Custom Detections with the SHA-256 hashes of all…

Simple Custom Detections block files based on hash, not path or publisher.

Study all Endpoint Protection and Detection common traps →

A
Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.
Why wrong: Default policy blocks known malware but not all untrusted executables by path.
B
Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.
Application Control allows blocking by path and creating exceptions based on publisher certificate.
C
Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.
Why wrong: Exclusions prevent scanning, not execution; they do not block execution.
D
Enable Simple Custom Detections with the SHA-256 hashes of all known executables.
Why wrong: Simple Custom Detections block files based on hash, not path or publisher.

Full breakdown with real-world context →

Question 17hardmulti select

Read the full network assurance explanation →

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Trap 1: Real-time blocking of malicious processes at the endpoint

Real-time blocking is performed by the AMP endpoint agent, not CTR.

Trap 2: Automatic deployment of software patches to endpoints

Patch management is outside CTR's scope; it focuses on detection and response.

Study all Endpoint Protection and Detection common traps →

A
Real-time blocking of malicious processes at the endpoint
Why wrong: Real-time blocking is performed by the AMP endpoint agent, not CTR.
B
Device Trajectory to visualize the timeline of events on an endpoint
Device Trajectory is a key feature in AMP/CTR for reconstructing events.
C
Centralized search across endpoint, network, and email telemetry
CTR aggregates telemetry from multiple sources for unified search.
D
Automatic deployment of software patches to endpoints
Why wrong: Patch management is outside CTR's scope; it focuses on detection and response.
E
Casebook creation to document investigation steps and share with team
CTR allows creating casebooks to track investigations.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full DHCP explanation →

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip verify source
 ip dhcp snooping limit rate 10
 ip dhcp snooping trust
!
interface GigabitEthernet0/2
 switchport mode access
 ip verify source
 ip dhcp snooping limit rate 5
!
ip dhcp snooping vlan 10
!
ip source binding 0050.7966.6801 vlan 10 192.168.1.10 interface GigabitEthernet0/2

Trap 1: The switch sends an ARP probe to verify the IP is unused, then…

IP Source Guard does not perform ARP probes; it drops mismatched traffic.

Trap 2: The switch updates the binding table to allow 192.168.1.20.

The binding table is not dynamic; it requires DHCP or manual entry.

Trap 3: The switch allows the traffic because the host is trusted on that…

The port is not trusted; trust is only on G0/1. The binding table restricts allowed IPs.

Study all Endpoint Protection and Detection common traps →

A
The switch drops all traffic from the host with source IP 192.168.1.20.
IP Source Guard filters traffic based on the binding table; unmatched source IPs are dropped.
B
The switch sends an ARP probe to verify the IP is unused, then updates the binding.
Why wrong: IP Source Guard does not perform ARP probes; it drops mismatched traffic.
C
The switch updates the binding table to allow 192.168.1.20.
Why wrong: The binding table is not dynamic; it requires DHCP or manual entry.
D
The switch allows the traffic because the host is trusted on that port.
Why wrong: The port is not trusted; trust is only on G0/1. The binding table restricts allowed IPs.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Endpoint Protection and Detection sessions

Start a Endpoint Protection and Detection only practice session

Every question in these sessions is drawn from the Endpoint Protection and Detection domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Endpoint Protection and Detection questions →Mixed 350-701 session

Frequently asked questions

What does the 350-701 exam test about Endpoint Protection and Detection?: IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Endpoint Protection and Detection questions in a focused session?: Yes — the session launcher on this page draws every question from the Endpoint Protection and Detection domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-701 topics?: Use the topic links above to move to related areas, or go back to the 350-701 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-701 exam covers. They are not copied from any real exam or dump site.

Endpoint Protection and Detection only

10 questions 20 questions 30 questions 50 questions

Mixed 350-701 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-701 questions Endpoint Protection and Detection domain overview 350-701 exam guide

Exam traps to avoid

▸Link-local addresses are not routable beyond the local link.
▸SLAAC uses EUI-64 or random interface IDs — not a DHCP server.
▸NDP uses ICMPv6, not ARP.
▸An IPv6 prefix is /64 for most host subnets, not /24.

Endpoint Protection and Detection practice questions

What to know about Endpoint Protection and Detection

Common Endpoint Protection and Detection exam traps

Endpoint Protection and Detection questions

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

Exhibit

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Exhibit

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Exhibit

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Exhibit

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Track your progress over time

Start a Endpoint Protection and Detection only practice session

Related 350-701 topic practice pages