5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An organization is using Cisco WSA with AMP for Content Security. They have a requirement to block all downloads of files with a 'malicious' disposition, but they are concerned about the performance impact of sandboxing every unknown file. They want to minimize the number of files sent to the sandbox while still blocking known malware. What should they configure?

   • AIncrease the file size threshold for sandboxing to reduce the number of files.
   • BSet the AMP action to 'Block' for malicious files and 'Allow' for unknown files, but enable sandboxing only for files from untrusted sites.
   • CSet the AMP action to 'Block' for all files that are not in the allow list.
   • DDisable sandboxing entirely and rely on reputation only.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security administrator is using the AMP for Endpoints console to investigate a detection. They see that a file was detected as malware on one endpoint, but the same file was allowed on another endpoint. The administrator suspects that the policies are different between the two groups. What should they do to confirm this?

   • AReinstall the connector on the endpoint that allowed the file.
   • BCompare the group policies for the two endpoints in the console.
   • CCheck the endpoint's local event logs for the file execution.
   • DUse the 'File' search to see the disposition of the file.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   An organization is deploying AMP for Networks in a high-availability pair. They want to ensure that if one appliance fails, the other can continue to block malicious files without interruption. Which deployment mode should they use?

   • AUse a load balancer in front of the appliances.
   • BInline mode with both appliances in series.
   • CInline mode with failover configuration.
   • DPassive mode with both appliances receiving the same SPAN traffic.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is deploying AMP for Endpoints on a mix of Windows and macOS devices. They want to ensure that all endpoints receive the same protection policies, but they also need to apply different settings for macOS due to performance constraints. What is the best approach?

   • ACreate separate groups for Windows and macOS and apply different policies to each.
   • BUse the same group but create a policy that automatically adjusts based on OS.
   • CApply the same policy to all endpoints and disable certain features on macOS manually.
   • DDeploy AMP for Endpoints only on Windows devices.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security team is using AMP for Networks and AMP for Endpoints. They want to correlate threat intelligence across both platforms to identify if a file that was seen on the network has also been executed on any endpoints. Which approach should they use?

   • AExport logs from both platforms and manually correlate them.
   • BUse the AMP for Networks dashboard to see the file's disposition.
   • CUse the AMP Threat Grid API to get a global view.
   • DUse the AMP for Endpoints console to search for the file's SHA256 and view the 'Computers' tab.
   Reveal Solution Discussion Select an answer first