350-701 Endpoint Protection and Detection Practice Question
Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?
⚠ Common exam trap
Cisco often tests the distinction between 'Block execution' and 'Quarantine' as the only two direct actions available for malicious files, tricking candidates into selecting 'Delete' or 'Allow' which are not supported actions in the AMP for Endpoints console.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block execution of the file
Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow the file after a scan
Why it's wrong here
Allowing a malicious file is not a protective action.
- ✓
Block execution of the file
Why this is correct
Block prevents the file from running.
- ✗
Encrypt the file to prevent harm
Why it's wrong here
Encryption is not a security action for detected malware.
- ✗
Delete the file
Why it's wrong here
AMP does not delete files; it blocks, quarantines, or allows.
- ✓
Quarantine the file into a safe location
Why this is correct
Quarantine isolates the file from the system.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.