350-701 Endpoint Protection and Detection Practice Question
Which TWO of the following are valid detection methods used by Cisco AMP for Endpoints to identify malicious activity?
⚠ Common exam trap
Cisco often tests the distinction between AMP for Endpoints and other Cisco security products (like Firepower IPS), leading candidates to incorrectly select signature-based IPS scanning as an AMP detection method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit Prevention using vulnerability-based rules
Cisco AMP for Endpoints includes Exploit Prevention, which uses vulnerability-based rules to detect and block exploit attempts targeting specific software vulnerabilities. These rules are tailored to the exploit technique rather than the malware file itself, allowing protection against zero-day exploits that leverage known vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exploit Prevention using vulnerability-based rules
Why this is correct
AMP Exploit Prevention blocks exploitation techniques.
- ✗
Heuristic analysis of unknown files
Why it's wrong here
Heuristic analysis is not a built-in AMP detection method.
- ✓
File Reputation via cloud lookups
Why this is correct
AMP checks file hashes against the cloud for known threats.
- ✗
Anomaly-based behavioral detection
Why it's wrong here
AMP does not use behavioral anomaly detection by default.
- ✗
Signature-based IPS scanning
Why it's wrong here
AMP does not perform network-level IPS scanning.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.