350-701 Endpoint Protection and Detection Practice Question
Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?
⚠ Common exam trap
Cisco often tests the misconception that aggressive blocking (e.g., blocking all 'Unknown' files or setting 'Block' as the default action) is a best practice, when in reality, a phased approach starting with 'Audit' or 'Detect' mode is recommended to avoid breaking production systems and to fine-tune policies based on actual traffic patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the AMP connector to all endpoints, including servers and desktops.
Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.
Why it's wrong here
Blocking unknowns leads to false positives; use cloud analysis and behavioral detection.
- ✓
Deploy the AMP connector to all endpoints, including servers and desktops.
Why this is correct
Comprehensive coverage is key for endpoint protection.
- ✓
Create separate groups for different operating systems and applications to apply tailored policies.
Why this is correct
Group-based policies allow fine-tuning per OS and app requirements.
- ✓
Start with 'Audit' or 'Detect' mode to baseline and adjust before enforcing blocks.
Why this is correct
Phased deployment allows tuning to minimize disruptions.
- ✗
Set the default policy action to 'Block' for all file types to maximize security from day one.
Why it's wrong here
Blocking all file types initially causes high false positives; start with audit.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.