350-701 Endpoint Protection and Detection Practice Question
Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?
⚠ Common exam trap
Cisco often tests the distinction between endpoint-based detection (AMP) and network-based detection (e.g., Umbrella, Stealthwatch), leading candidates to incorrectly select network-related IOCs like malicious DNS queries or anomalous traffic patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack techniques (e.g., PowerShell injection)
Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Malicious DNS queries
Why it's wrong here
DNS monitoring is typically done by network security devices, not endpoint AMP.
- ✗
Phishing email headers
Why it's wrong here
Email header analysis is done by email security, not endpoint AMP.
- ✓
Fileless attack techniques (e.g., PowerShell injection)
Why this is correct
AMP behavioral analysis detects fileless attacks by monitoring process behavior.
- ✓
File-based malware (via file reputation and analysis)
Why this is correct
AMP uses file reputation to detect known and unknown malware.
- ✗
Anomalous network traffic patterns
Why it's wrong here
Network traffic analysis is beyond endpoint AMP scope; it focuses on files and processes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.