5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 12)

Questions 56–59

1. 56application · medium

   An administrator is configuring AMP for Networks policies. They want to ensure that files from a specific business-critical application server are never sandboxed, but still allow the server's files to be checked for reputation. Which policy setting should be applied?

   • ADisable AMP for that network segment entirely.
   • BAdd the server's IP to the 'Block List' to ensure no files are sent out.
   • CSet the global file analysis action to 'Block' for all unknown files.
   • DAdd the server's IP address to the 'Allow List' and set the file analysis action to 'Detect' for that IP.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A network administrator notices that AMP for Networks is not blocking any files, even though the policy is set to 'Block' for malicious files. The AMP appliance is deployed in inline mode. What is the most likely cause?

   • AThe AMP appliance is not receiving traffic because it is connected to a SPAN port.
   • BThe file reputation threshold is set too high.
   • CThe policy is applied to the wrong interface.
   • DThe AMP cloud is not reachable from the appliance.
   Reveal Solution Discussion Select an answer first
4. 58application · medium · select all that apply

   A security team is evaluating Cisco AMP for Endpoints to protect against advanced threats. They want to utilize multiple layers of defense. Which of the following are protection features available in AMP for Endpoints? (Select all that apply.)

   • ANetwork firewall with stateful inspection.
   • BExploit prevention that blocks common exploit techniques.
   • CFile reputation checks using the AMP cloud.
   • DSandboxing of files on the endpoint itself.
   • EBehavioral protection that monitors for malicious activities.
   Check answers Discussion Select an answer first
5. 59application · medium

   A company uses Cisco ESA with AMP for Content Security. A user received an email with an attachment that was initially unknown and allowed through. Later, the AMP cloud determines the file is malicious. What action should the administrator take to remediate the threat?

   • ADo nothing because the file was already delivered.
   • BConfigure the ESA to automatically quarantine the email when the file disposition changes to malicious.
   • CUse the ESA's 'Message Tracking' to find the email and manually delete it from the user's mailbox.
   • DBlock the sender's email address in the ESA.
   Reveal Solution Discussion Select an answer first