5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is deploying Cisco AMP for Networks in inline mode at the internet edge. The security team wants to ensure that files that are initially unknown are not allowed to pass through to users while the sandbox analysis is in progress. They also want to receive an alert if a file that was previously allowed is later determined to be malicious. Which two configurations must be combined to meet these requirements?

   • AEnable file reputation lookups only and set the action to 'Detect' for unknown files.
   • BSet the file analysis action to 'Allow' and rely on the sandbox to update the reputation cache.
   • CUse a network allow list for all file types to avoid false positives.
   • DSet the file analysis action to 'Block' for unknown files and enable retrospective alerting.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An administrator is using the AMP for Endpoints console to investigate a detection on a single endpoint. They want to see the full timeline of events leading up to the detection, including the file's origin and any network connections made. Which view should the administrator use?

   • AEvent Log
   • BReports
   • COutbreak Control
   • DDevice Trajectory
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company uses Cisco ESA with AMP for Content Security. They want to ensure that if a user clicks a link in an email that leads to a malicious file download, the download is blocked by the WSA. Which integration should be configured?

   • AIntegrate the ESA with the WSA using the Cisco Content Security Management Appliance (SMA) to share threat intelligence.
   • BEnable AMP for Endpoints on the user's machine to block the download.
   • CConfigure the ESA to rewrite all URLs to go through the WSA proxy.
   • DUse the ESA's local anti-virus to block the link.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is evaluating AMP for Networks to detect zero-day malware. They want to ensure that files that are not known to the reputation service are sent to the sandbox for analysis. They also want to receive a notification if the sandbox determines that a file is malicious after it has already been allowed. Which feature set should they enable?

   • AEnable file reputation and sandboxing, and configure retrospective alerting.
   • BEnable file reputation only, and rely on the local cache for unknown files.
   • CEnable retrospective analysis only, and rely on the sandbox to update the reputation.
   • DEnable sandboxing only, and disable file reputation to save resources.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large enterprise is deploying AMP for Endpoints across 10,000 endpoints. They have a mix of Windows, macOS, and Linux servers. The security team wants to ensure that all endpoints are protected even if they are not connected to the corporate network for long periods. They also want to minimize the administrative overhead of managing the connectors. Which deployment model should be chosen?

   • ACloud-managed deployment with connectors that can operate offline and sync when connectivity is available.
   • BOn-premises management console with connectors that require VPN connectivity.
   • CStandalone deployment with no central management, using local policies.
   • DHybrid deployment with some endpoints managed on-premises and others in the cloud.
   Reveal Solution Discussion Select an answer first