Courseiva
Endpoint Protection and DetectioneasyMultiple SelectObjective-mapped

350-701 Endpoint Protection and Detection Practice Question

Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?

⚠ Common exam trap

Cisco often tests the distinction between 'Block execution' and 'Quarantine' as the only two direct actions available for malicious files, tricking candidates into selecting 'Delete' or 'Allow' which are not supported actions in the AMP for Endpoints console.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Block execution of the file

Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Allow the file after a scan

    Why it's wrong here

    Allowing a malicious file is not a protective action.

  • Block execution of the file

    Why this is correct

    Block prevents the file from running.

  • Encrypt the file to prevent harm

    Why it's wrong here

    Encryption is not a security action for detected malware.

  • Delete the file

    Why it's wrong here

    AMP does not delete files; it blocks, quarantines, or allows.

  • Quarantine the file into a safe location

    Why this is correct

    Quarantine isolates the file from the system.

About these practice questions

This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.