An organization is deploying Cisco AMP for Endpoints to protect 500 Windows laptops. The security team wants to minimize the performance impact on end-user devices while still gaining visibility into file executions and blocking known malware. Which deployment approach should they choose?

Enable exploit prevention and behavioral protection on all endpoints.

Install the AMP connector with default settings and enable the TETRA engine.

Use the AMP for Endpoints console to disable all real-time scans.

Install the connector in passive mode to only log file executions.

An administrator is configuring AMP for Networks and wants to ensure that files from a specific business application are never blocked, even if they are malicious. The administrator also wants to receive an alert if such a file is detected. What should they do?

Set the global file analysis action to 'Block' and add an exception for the application's IP.

Add the application's IP to the block list to prevent any file transfer.

Disable AMP for that network segment.

Add the application's IP to the allow list and set the file analysis action to 'Detect' for that IP.

A company uses Cisco ESA for email security. They want to leverage AMP to analyze email attachments that are unknown to the reputation service. The security team requires that if a file is later found malicious, the email should be quarantined retroactively. Which configuration should be implemented?

Enable AMP for Content Security on the ESA and configure the 'retrospective' action to quarantine.

Set the ESA to use the local malware engine only, without AMP integration.

Configure the ESA to drop all emails with attachments.

Use the ESA's content filter to block attachments based on file type.

A company is deploying Cisco WSA as a forward proxy. They want to use AMP to block downloads of known malicious files and also sandbox unknown files. The network team is concerned about latency for large file downloads. Which WSA configuration should be used?

Enable AMP and configure the WSA to stream files to the client while the AMP cloud analyzes them.

Disable AMP for files larger than a certain size to avoid latency.

Use the WSA's URL filtering instead of AMP for file blocking.

Enable AMP on the WSA and set the file reputation threshold to 'high' for blocking.

A security analyst is investigating a malware outbreak using the AMP for Endpoints console. They need to identify all endpoints that have executed a specific malicious file SHA256 and determine if any files related to that malware are still present. Which console feature should they use?

Use the 'File' search to find the SHA256 and view the 'Computer' tab for affected endpoints.

Use the 'Group' management to push a new policy to all endpoints.

Use the 'Events' tab to filter by detection type and time range.

Use the 'Outbreak Control' feature to block the file globally.

CCIE Security

Domain 5Objective 1

5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 11)

Part of the 5.0 Advanced Threat Protection and Content Security domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

20%of the exam

Questions 51–55

51application · medium
An organization is deploying Cisco AMP for Endpoints to protect 500 Windows laptops. The security team wants to minimize the performance impact on end-user devices while still gaining visibility into file executions and blocking known malware. Which deployment approach should they choose?
Select an answer first
52expert · hard
An administrator is configuring AMP for Networks and wants to ensure that files from a specific business application are never blocked, even if they are malicious. The administrator also wants to receive an alert if such a file is detected. What should they do?
Select an answer first
53application · medium
A company uses Cisco ESA for email security. They want to leverage AMP to analyze email attachments that are unknown to the reputation service. The security team requires that if a file is later found malicious, the email should be quarantined retroactively. Which configuration should be implemented?
Select an answer first
54application · medium
A company is deploying Cisco WSA as a forward proxy. They want to use AMP to block downloads of known malicious files and also sandbox unknown files. The network team is concerned about latency for large file downloads. Which WSA configuration should be used?
Select an answer first
55application · medium
A security analyst is investigating a malware outbreak using the AMP for Endpoints console. They need to identify all endpoints that have executed a specific malicious file SHA256 and determine if any files related to that malware are still present. Which console feature should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.