350-701 Endpoint Protection and Detection Practice Question
Which THREE of the following are recommended best practices for configuring Cisco AMP for Endpoints to minimize false positives while maintaining strong detection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable file reputation scanning with cloud lookups
Options B, C, and E are correct. Option B (File reputation scanning with cloud lookups) validates files against cloud intelligence, allowing known good files to reduce false positives. Option C (Application blocking with a whitelist of approved software) ensures only trusted applications run, minimizing false alerts. Option E (Exclusions for directories where trusted software is installed) prevents scanning of benign files, lowering false positives while maintaining detection for unknowns. Option A is incorrect because setting scan level to maximum for all file types increases false positives without significant detection gain. Option D is incorrect because disabling exploit prevention weakens security and is not recommended.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set scan level to maximum for all file types
Why it's wrong here
Maximum scan level increases false positives by triggering on low-risk files without improving detection.
- ✓
Enable file reputation scanning with cloud lookups
Why this is correct
File reputation scanning leverages cloud intelligence to classify files, reducing false positives from known good files.
- ✓
Use application blocking with a whitelist of approved software
Why this is correct
Whitelisting approved applications reduces false positives by allowing only vetted software.
- ✗
Disable exploit prevention to reduce false positives
Why it's wrong here
Disabling exploit prevention weakens endpoint protection against zero-day exploits, increasing risk.
- ✓
Configure exclusions for directories where trusted software is installed
Why this is correct
Exclusions for trusted directories prevent unnecessary scanning of legitimate software, reducing false positives.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.