5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the role of the AMP cloud in the Cisco ESA integration for email security?

   • ATo act as a mail transfer agent (MTA)
   • BTo provide spam filtering
   • CTo store email messages for compliance
   • DTo provide real-time file reputation and sandboxing for email attachments
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the Cisco WSA integration with AMP, what happens when a user downloads a file that is unknown to the AMP cloud?

   • AThe WSA quarantines the file for manual review.
   • BThe WSA drops the connection.
   • CThe file is allowed, but the WSA sends it to the AMP cloud for sandboxing.
   • DThe file is immediately blocked.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary benefit of integrating Cisco AMP with Cisco WSA for web traffic?

   • AIt provides DLP (Data Loss Prevention) for web traffic.
   • BIt provides URL filtering based on category.
   • CIt enables real-time blocking of malicious downloads based on file reputation and sandboxing.
   • DIt encrypts all web traffic.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary source of threat intelligence used by Cisco AMP to identify and remediate advanced threats?

   • ANetwork traffic logs
   • BLocal signature databases on the endpoint
   • CUser-defined allow lists
   • DCisco Talos threat intelligence
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does retrospective analysis in AMP help remediate advanced threats that were initially undetected?

   • AIt re-evaluates files that were previously allowed and, if they are now found malicious, alerts and can trigger remediation actions.
   • BIt deletes all files that have been on the system for more than 30 days.
   • CIt immediately blocks all files that were previously allowed.
   • DIt quarantines all files that have a low reputation score.
   Reveal Solution Discussion Select an answer first