5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security architect is designing a defense-in-depth strategy. They have deployed AMP for Endpoints with Exploit Prevention and Behavioral Protection. However, they are concerned about a specific exploit that uses a legitimate system tool (e.g., PowerShell) to execute malicious scripts. The exploit is not a memory-corruption attack and does not involve process injection. Which additional AMP feature should be enabled to detect and block this type of attack?

   • AEnable Malware Protection with script analysis.
   • BEnable Application Control to block PowerShell.
   • CEnable Device Control to block USB devices.
   • DEnable Network Protection to block command-and-control traffic.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An incident responder is using the AMP for Endpoints console to investigate a widespread malware infection. The malware has been detected on multiple endpoints, and the responder wants to see all endpoints that have the same file SHA-256 hash. They also want to know the first time the file was seen on each endpoint. Which console feature provides this information?

   • AFile Trajectory view, which shows the file's activity across all endpoints.
   • BOutbreak Control to quarantine the file.
   • CEvent Log with a filter for the file hash.
   • DDevice Trajectory view for each endpoint individually.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is using Cisco ESA with AMP for Content Security. They have a policy that allows emails with unknown attachments to be delivered, but they want to automatically remove the email from the user's mailbox if the attachment is later found malicious. They also want to notify the user that the email was removed. Which configuration should be used?

   • AUse the ESA's local anti-virus to quarantine the email after delivery.
   • BConfigure the ESA to drop the email and send a notification to the user.
   • CConfigure the ESA to block all unknown attachments at the gateway.
   • DConfigure the ESA to use the 'Retrospective' action with a message disposition that allows the email and later quarantines it, and enable user notifications.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security operations center (SOC) is using AMP for Networks and AMP for Endpoints. They receive an alert that a file was detected as malicious by the AMP for Networks sandbox. The file was previously allowed on the network. The SOC wants to identify which endpoints may have been affected by this file and remediate them. Which approach should be used?

   • AUse the AMP for Endpoints console to search for the file hash and then manually delete it from each endpoint.
   • BUse the AMP for Networks console to quarantine the file on all endpoints.
   • CUse the AMP for Networks reporting to identify the source IP of the download and then block that IP.
   • DUse the AMP for Networks retrospective alert to identify the file hash, then search the AMP for Endpoints console for that hash to find affected endpoints and use Outbreak Control to quarantine.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A network administrator is troubleshooting an issue where AMP for Networks is not blocking files that are known to be malicious. The administrator has verified that the policy is set to 'Block' and the appliance is in inline mode. The AMP for Networks dashboard shows that the appliance is receiving traffic. What is the most likely cause of this issue?

   • AThe policy is configured to 'Detect' instead of 'Block'.
   • BThe appliance is in passive mode, so it cannot block traffic.
   • CThe appliance is not receiving traffic on the correct interface.
   • DThe file reputation service is not reachable, and the appliance is configured to fail-open.
   Reveal Solution Discussion Select an answer first