A company has deployed an EPP solution but is experiencing a high number of false positives that are disrupting business operations. They are considering adding an EDR solution. What is the most effective way to use EDR to reduce false positives?

Increase EPP sensitivity to catch more threats

Disable EPP alerts and rely on EDR only

Use EDR to investigate and whitelist legitimate applications

Use EDR to automatically quarantine all flagged files

Which statement correctly distinguishes between EPP and EDR solutions?

EPP is primarily for prevention, while EDR is primarily for detection and response.

EPP focuses on detection and response, while EDR focuses on prevention.

EPP and EDR are interchangeable terms for the same solution.

EPP is a subset of EDR that only handles antivirus.

A security operations center (SOC) wants to reduce alert fatigue while maintaining strong endpoint protection. They currently use separate EPP and EDR tools that do not share data. What is the most effective improvement?

Increase the number of EDR alerts

Disable EDR alerts and rely on EPP only

Use a separate SIEM to collect logs

Integrate EPP and EDR to correlate events and reduce false positives

CiscoCertified Network Professional Security

Domain 5Objective 1

5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) Solutions 350-701 Practice Questions (Page 3)

Part of the Endpoint Protection and Detection domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

15%of the exam

Questions 11–15

11application · medium
During an incident, an analyst identifies a malicious process running on a server. The analyst wants to stop the process and prevent it from communicating with its command-and-control server. Which EDR capability is most appropriate?
Select an answer first
12expert · hard
A company has deployed an EPP solution but is experiencing a high number of false positives that are disrupting business operations. They are considering adding an EDR solution. What is the most effective way to use EDR to reduce false positives?
Select an answer first
13expert · hard
A security team is responding to a ransomware outbreak. They have isolated the affected endpoints using the EDR. However, they need to determine the initial infection vector to prevent future outbreaks. Which EDR capability is most useful?
Select an answer first
14foundation · easy
Which statement correctly distinguishes between EPP and EDR solutions?
Select an answer first
15application · medium
A security operations center (SOC) wants to reduce alert fatigue while maintaining strong endpoint protection. They currently use separate EPP and EDR tools that do not share data. What is the most effective improvement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) Solutions 350-701 Practice Questions (Page 3)

Questions 11–15

During an incident, an analyst identifies a malicious process running on a server. The analyst wants to stop the process and prevent it from communicating with its command-and-control server. Which EDR capability is most appropriate?

A company has deployed an EPP solution but is experiencing a high number of false positives that are disrupting business operations. They are considering adding an EDR solution. What is the most effective way to use EDR to reduce false positives?

A security team is responding to a ransomware outbreak. They have isolated the affected endpoints using the EDR. However, they need to determine the initial infection vector to prevent future outbreaks. Which EDR capability is most useful?

Which statement correctly distinguishes between EPP and EDR solutions?

A security operations center (SOC) wants to reduce alert fatigue while maintaining strong endpoint protection. They currently use separate EPP and EDR tools that do not share data. What is the most effective improvement?

Keep studying — Endpoint Protection and Detection