An incident responder needs to determine whether a specific file was executed on any endpoint in the organization during the past month. Which EDR feature would be most useful?

Searchable process execution logs

An organization wants to reduce the risk of a zero-day exploit executing on endpoints. They already have a signature-based antivirus. Which additional EPP capability would be most effective?

More frequent signature updates

Behavioral analysis and heuristics

A security analyst receives an alert from the EDR console about a suspicious PowerShell script on a user's laptop. The script is not flagged by the EPP's signature database. What is the best next step for the analyst?

Use the EDR's investigation tools to examine the script's behavior and origin

Ignore the alert because the EPP did not flag it

Immediately reinstall the operating system on the laptop

Disable the EPP on the laptop to avoid false positives

A security analyst is evaluating endpoint security tools and needs to select a solution that primarily focuses on preventing known malware from executing on endpoints. Which type of solution best fits this requirement?

Endpoint Protection Platform (EPP)

Security Information and Event Management (SIEM)

A company is evaluating endpoint security tools. They need a solution that can block known malware at the point of execution and also provide a forensic timeline of an attacker's activities after a breach. Which combination of products would best meet these requirements?

An EPP solution integrated with an EDR solution

A firewall with intrusion prevention

CiscoCertified Network Professional Security

Domain 5Objective 1

5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) Solutions 350-701 Practice Questions (Page 2)

Part of the Endpoint Protection and Detection domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

15%of the exam

Questions 6–10

6application · medium
An incident responder needs to determine whether a specific file was executed on any endpoint in the organization during the past month. Which EDR feature would be most useful?
Select an answer first
7application · medium
An organization wants to reduce the risk of a zero-day exploit executing on endpoints. They already have a signature-based antivirus. Which additional EPP capability would be most effective?
Select an answer first
8application · medium
A security analyst receives an alert from the EDR console about a suspicious PowerShell script on a user's laptop. The script is not flagged by the EPP's signature database. What is the best next step for the analyst?
Select an answer first
9foundation · easy
A security analyst is evaluating endpoint security tools and needs to select a solution that primarily focuses on preventing known malware from executing on endpoints. Which type of solution best fits this requirement?
Select an answer first
10application · medium
A company is evaluating endpoint security tools. They need a solution that can block known malware at the point of execution and also provide a forensic timeline of an attacker's activities after a breach. Which combination of products would best meet these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.