5.5 Configure Endpoint Antimalware Protection Using Cisco Secure Endpoint 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of endpoint isolation in Cisco Secure Endpoint?

   • ATo uninstall the connector from the endpoint
   • BTo remove the endpoint from the Secure Endpoint Console
   • CTo update the endpoint's operating system
   • DTo prevent an infected endpoint from communicating with other devices
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst has isolated an endpoint that is suspected of being infected. The analyst has completed the investigation and wants to restore the endpoint to normal operation. What should be done?

   • AReinstall the connector
   • BRemove the isolation
   • CChange the policy to a more restrictive one
   • DDelete the endpoint from the console
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to ensure that endpoints receive real-time threat intelligence from the AMP cloud. The security team is configuring the connector. Which setting must be enabled?

   • ACloud lookup
   • BLocal signature updates
   • CBehavioral analysis
   • DFile quarantine
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst has identified a malicious file on an endpoint and wants to remove it while preserving the file for further analysis. Which action should be taken?

   • AQuarantine the file
   • BAllow the file
   • CIsolate the endpoint
   • DDelete the file
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a retrospective alert for a file that was initially allowed but later found to be malicious. The analyst needs to identify all endpoints that executed the file and determine the initial entry point. The analyst also needs to contain the spread by isolating affected endpoints. What is the most efficient sequence of actions?

   • AIsolate all endpoints, then use file trajectory to investigate
   • BUse file trajectory to identify affected endpoints, then isolate them
   • CUse device trajectory for each endpoint, then quarantine the file
   • DQuarantine the file, then use file trajectory to identify affected endpoints
   Reveal Solution Discussion Select an answer first