5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network administrator is deploying Cisco AMP for Networks in a high-availability pair. They want to ensure that if the primary appliance fails, the secondary appliance can take over without interrupting traffic inspection. They also need to be able to generate a report showing the number of files blocked by AMP over the last month. Which deployment mode and reporting feature should be used?

   • ADeploy in inline mode with failover and use the AMP for Networks reporting dashboard to generate the report.
   • BDeploy in SPAN mode and use the AMP for Endpoints console for reporting.
   • CDeploy in inline mode without failover and use the CLI to generate reports.
   • DDeploy in passive mode and use the Firepower Management Center for reporting.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company has deployed Cisco AMP for Endpoints on all Windows workstations. They want to protect against memory-corruption attacks that exploit vulnerabilities in applications. They also want to ensure that if a new process tries to inject code into another process, it is blocked. Which two protection features should be enabled?

   • AEnable Malware Protection and File Reputation.
   • BEnable Exploit Prevention and Behavioral Protection.
   • CEnable Application Control and Device Control.
   • DEnable Network Protection and Web Protection.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network administrator notices that the AMP for Networks appliance is not blocking any files, even though the policy is set to block malicious files. The administrator checks the AMP for Networks dashboard and sees that the appliance is receiving traffic. What is the most likely cause of this issue?

   • AThe appliance is deployed in passive mode, so it cannot block traffic.
   • BThe file reputation service is down, so all files are allowed.
   • CThe policy is configured to 'Detect' instead of 'Block'.
   • DThe appliance is not receiving traffic on the correct interface.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company wants to allow a specific internal application to download a file that is currently flagged as malicious by AMP for Networks. The file is used by the application and is known to be safe. The security team wants to ensure that this file is not blocked for any user. What should be configured in the AMP for Networks policy?

   • AChange the AMP action to 'Detect' for all files.
   • BUse the sandbox to re-analyze the file and hope it gets a clean verdict.
   • CDisable AMP for the specific application's traffic.
   • DAdd the file's SHA-256 hash to the allow list in the AMP policy.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is deploying Cisco AMP for Networks in inline mode at the internet edge. The security team wants to block known malware files immediately while allowing unknown files to be sandboxed for analysis. They also need to ensure that files from a trusted internal file server are never blocked. Which configuration should be applied?

   • ASet the AMP policy to 'detect only' mode and rely on retrospective alerts.
   • BEnable sandboxing for all files and disable file reputation checks.
   • CUse a NetFlow export policy to send file metadata to the AMP cloud.
   • DEnable file reputation on the AMP policy and add the internal server IP to the allow list.
   Reveal Solution Discussion Select an answer first