5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization is deploying Cisco AMP for Endpoints to protect a mix of Windows and macOS laptops. The security team wants to ensure that if a user disconnects from the corporate VPN, the endpoint still receives protection and can send telemetry to the cloud. They also want to prevent a specific application from being installed on all endpoints. Which deployment and policy settings should be used?

   • AUse a VPN-only deployment and rely on the firewall to block the application.
   • BDeploy the connector in standalone mode and use a local malware policy to block the application.
   • CDeploy the connector with cloud-based management and create an application control policy to block the application.
   • DDeploy the connector with a local console and use exploit prevention to block the application.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security administrator is configuring AMP for Networks to protect against ransomware. They want to block files that are known to be ransomware, but they also want to allow a specific file that is used by a legitimate internal application, even though the file's reputation is 'malicious' due to a false positive. The administrator has the file's SHA-256 hash. What is the best way to achieve this?

   • ADisable AMP for the internal application's traffic.
   • BAdd the file's SHA-256 hash to the allow list in the AMP policy.
   • CUse the sandbox to re-analyze the file and hope it gets a clean verdict.
   • DChange the AMP action to 'Detect' for all files.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company uses Cisco ESA for email security. They want to leverage AMP to analyze email attachments that are not yet known to the reputation service. The security team requires that if a file is later found malicious, the original email should be automatically removed from user mailboxes. Which configuration should be implemented?

   • AConfigure the ESA to drop all emails with attachments that have a low reputation score.
   • BBlock all unknown attachments at the gateway to prevent any risk.
   • CEnable AMP for Content Security on the ESA and configure a message disposition that allows the email but later performs a 'retrospective' quarantine.
   • DUse the ESA's local anti-virus only and rely on users to delete suspicious emails.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is integrating Cisco WSA with AMP for Content Security. They want to block downloads of files that are known malicious, but for unknown files they want to allow the first download and then block subsequent downloads if the file is later found malicious. What is the correct configuration approach?

   • ASet the AMP policy to 'Detect' and rely on the user to avoid the file.
   • BSet the AMP policy to 'Block' for unknown files to prevent any risk.
   • CDisable AMP and use the WSA's URL filtering to block malicious sites.
   • DSet the AMP policy to 'Allow' for unknown files and enable 'Retrospective' blocking.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is investigating a potential malware outbreak in the organization. They notice that a file was allowed by AMP for Endpoints three days ago, but now the AMP threat intelligence feed has updated the file's reputation to malicious. The analyst wants to identify all endpoints that have this file and remediate them. Which feature should the analyst use in the AMP for Endpoints console?

   • AUse the 'Event Log' to manually search for the file and then delete it from each endpoint.
   • BUse the 'Device Trajectory' for a single endpoint and then manually check other endpoints.
   • CUse the 'Reports' tab to generate a malware report and then send an email to users to delete the file.
   • DUse the 'Trajectory' view to see the file's activity and then use 'Outbreak Control' to quarantine the file on affected endpoints.
   Reveal Solution Discussion Select an answer first