Endpoint Protection and Detection

350-701 · 45 questions

• An organization relies on signature-based antivirus. An attacker uses a phishing macro to launch PowerShell, which downloads and runs a payload entirely in memory without writing an executable to disk, and the antivirus raises no alert. Which capability is designed to detect this kind of activity?
• Incident responders learn that a laptop was compromised about two weeks ago. They need to reconstruct which processes ran, which files were created and which network connections the host made since then. Which endpoint capability makes this possible?
• A security team's primary requirement is to stop known malware from running on workstations at all, by checking files when they are written or executed and blocking or quarantining any with a known malicious disposition. Which category of solution is built for this?
• A laptop shows signs of active compromise and may be spreading laterally. Responders need to cut it off from the rest of the network immediately while keeping it reachable from the security console so they can continue collecting evidence. Which EDR response action fits?
• Leadership asks how an XDR platform such as Cisco XDR differs from the EDR capability the organization already runs on its endpoints. Which explanation is accurate?
• A file was seen on several endpoints last week and judged clean when it arrived. Today new threat intelligence shows that the same file is malicious. How does Cisco Secure Endpoint handle the hosts that already received it?
• A threat intelligence report names a suspicious process used in recent intrusions. No alert has fired in the organization, but threat hunters want to check whether that process has ever run on any endpoint. Which approach fits?
• An employee reports that a company-owned smartphone enrolled in the organization's MDM was lost in an airport. The phone holds corporate email and documents. What is the most appropriate immediate action?
• Employees using personal phones for work insist that IT must not see or erase their personal photos and apps, while security requires that corporate email and files can be controlled and removed when an employee leaves. Which approach meets both requirements?
• A security team discovers devices on the network that appear in no system it manages: no EDR agent, no MDM record and no known owner. Before it can protect or monitor these endpoints, what must it establish first?
• A new policy requires every corporate phone to have a passcode of minimum complexity and device storage encryption enabled. The organization wants these settings enforced automatically and noncompliant devices reported. What should it use?
• An organization wants mobile devices to receive full network access only if its MDM reports them as enrolled and compliant; other devices should be redirected to enroll. Which design achieves this?
• A critical vulnerability is announced in a specific version of a PDF reader. The vulnerability team must identify every laptop running that version so it can prioritize remediation. Which data source answers this most directly?
• Corporate laptops connecting through Cisco ISE must have critical OS patches installed. Laptops missing them should not be blocked outright; they should receive only enough access to fix the problem and then gain full access. Which approach meets this requirement?
• Policy states that each Windows laptop must have an approved antimalware product installed with recently updated definitions. In Cisco ISE posture, how are these checks expressed so that the agent can evaluate them?
• Contractors bring their own Windows laptops for a two-week project. Policy requires a posture check before network access, but the contractors' employers forbid installing any persistent software on those laptops. Which Cisco ISE posture option fits?
• A corporate laptop has just authenticated with 802.1X, and the posture agent has not yet reported any result to Cisco ISE. What posture status does ISE hold for the endpoint, and what access does a typical posture design give it at this point?
• A noncompliant laptop should be able to reach only the internal patch server and the ISE nodes needed for posture, and nothing else, while remaining on its normal access VLAN. How is this enforced in a Cisco ISE design?
• A laptop passes posture at connection time. Hours later, the user disables the antimalware service, but the laptop keeps full network access until it reconnects the next day. Which Cisco ISE posture feature closes this gap?
• An unknown executable with no existing reputation arrives as an email attachment. The SOC wants to see what it actually does when run: files dropped, registry changes, processes spawned and network connections attempted. Which Cisco solution is designed for this?
• An administrator is planning a Cisco Secure Client rollout that must provide remote access VPN, ISE posture checks and endpoint flow visibility on corporate laptops. How should the deployment be approached?
• A Secure Malware Analytics report shows no hash match for a file in any reputation source, but it lists behavioral indicators such as modifying autorun registry keys, injecting into another process and contacting a recently registered domain, along with a high threat score. How should the analyst interpret it?
• A sample shows no malicious activity in the sandbox, yet the same file later compromises a physical workstation. Researchers find that it checks for virtual machine artifacts and sleeps for a long period before acting. What does this indicate about the analysis?
• A SOC wants suspicious files collected by several other security tools to be submitted to Cisco Secure Malware Analytics automatically, with verdicts returned to those tools, instead of analysts uploading samples by hand. What enables this?
• The security team wants endpoint flow records that show, for each network connection, which process on the laptop generated it and which user was logged in, including while the laptop is off the corporate network. Which Cisco Secure Client capability provides this?
• During a pilot of Cisco Secure Endpoint on production workstations, the team wants detections logged so it can find false positives, but nothing may be quarantined or blocked until the pilot ends. How should the policy be set?
• The SOC confirms that a file with a specific SHA-256 hash is malicious, but Cisco Secure Endpoint does not yet treat it as malicious. Analysts want every connector to detect and quarantine that exact file immediately. What should they configure?
• Company policy prohibits a specific remote-administration tool that is not malware and has no malicious disposition. Security wants Cisco Secure Endpoint to prevent that executable from running on any managed computer. Which feature fits?
• Cisco Secure Endpoint repeatedly scans a line-of-business application's data folder, slowing the application, and investigation confirms the files there are benign. What is the recommended way to address this?
• Servers running critical databases need a Cisco Secure Endpoint policy with different exclusions and protection settings from employee laptops, and both sets of computers are managed in the same organization. How should this be organized?
• Attackers are targeting a browser vulnerability that uses memory corruption to inject code into the running browser process, without dropping a malicious file. Which Cisco Secure Endpoint engine is designed to protect against this technique?
• A ransomware variant with no known file disposition starts encrypting user documents rapidly, launched by malicious scripts through built-in system tools. Which Cisco Secure Endpoint protections address this activity rather than relying on file reputation?
• Cisco Secure Endpoint shows a Threat Detected event followed by a Threat Quarantined event for the same file on one laptop. What is the correct next step?
• Cisco Secure Endpoint reports a Threat Detected event followed by a Quarantine Failure event for a malicious file on a server. How should this be interpreted?
• Cisco Secure Endpoint generates a retrospective detection for a file that executed on four laptops several days ago, when its disposition was unknown. What does this event mean for the response?
• An analyst needs to see how a malicious file arrived on one specific laptop, which process created it, what it executed afterward and which network connections followed. Which Cisco Secure Endpoint view is designed for this?
• After confirming that a file is malicious, an analyst must identify every computer in the organization where that file appeared, when it first arrived on each and which of those hosts executed it. Which Cisco Secure Endpoint view answers this?
• Cisco Secure Endpoint flags several indications of compromise on a laptop: a document opened from email spawned a scripting engine, a new persistence entry appeared and an unusual outbound connection followed. No file on the laptop was convicted. How should this be interpreted?
• An organization uses Microsoft 365 for email and wants Cisco Security Email Threat Defense, but the messaging team will not change MX records or place another gateway in the mail flow. Which deployment model fits?
• Cisco Security Email Threat Defense is connected to a Microsoft 365 tenant, but the security team must ensure it receives copies of incoming, outgoing and internal messages for analysis. What must be configured in Microsoft 365?
• A company uses Cisco Security Email Threat Defense with its Microsoft 365 tenant. The security team is tired of manually moving each malicious message out of user inboxes after the verdict appears and wants this to happen without analyst action. What should the team configure?
• Finance staff at a company protected by Cisco Security Email Threat Defense receive messages that impersonate the CFO and urge them to pay a new supplier invoice today. The messages contain no attachments and no links. Which verdict category is designed to catch this pattern?
• Yesterday a vendor-themed message reached 40 mailboxes and was judged clean. Today threat intelligence shows its embedded link is a credential-harvesting site. The company uses Cisco Security Email Threat Defense with Microsoft 365. What is the most effective response?
• An administrator configuring Cisco Security Email Threat Defense wants malicious and phishing messages taken out of reach of users, while ordinary spam should still be available to users if they want to check it. How should this be implemented?
• An analyst opens a message that Cisco Security Email Threat Defense flagged as phishing and must explain to the user's manager why it was flagged, without guessing from the subject line. Which information in the message view best supports that explanation?