5.1 Cisco AMP for Networks, Cisco AMP for Endpoints, and Cisco AMP for Content Security (Cisco ESA, and Cisco WSA) CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization is deploying AMP for Endpoints to 1,000 devices. They want to ensure that the connectors are always up to date and that the security team can quickly see which endpoints are not communicating with the AMP cloud. Which feature should they use?

   • ACheck the local event logs on each endpoint.
   • BSet up an email alert for any endpoint that has not checked in for 24 hours.
   • CUse the AMP for Endpoints console's 'Health' view to monitor connector status.
   • DUse the 'Group' management to force updates to all connectors.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network administrator is configuring AMP for Networks to detect and block malware. They want to ensure that if a file is initially unknown and later found malicious, the network is protected retroactively. Which feature should they enable?

   • AFile reputation checks only.
   • BSandboxing of all files.
   • CRetrospective analysis with automatic blocking of the file.
   • DAllow listing of all internal IPs.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   An administrator is troubleshooting an AMP for Networks deployment where the appliance is not receiving traffic. The appliance is connected to a switch port configured as a SPAN destination. The administrator expects to see traffic in the dashboard, but no data is shown. What is the most likely cause?

   • AThe SPAN source is configured to monitor only ingress traffic, but the appliance needs both ingress and egress.
   • BThe appliance is not configured with the correct VLAN filter for the SPAN session.
   • CThe appliance's management interface is being used for traffic capture instead of the data interface.
   • DThe SPAN destination port is configured as an access port, but the appliance expects trunking.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security analyst is using AMP for Endpoints to investigate a potential advanced persistent threat. They notice that a file with a low reputation score was executed on several endpoints, but the file was not blocked because the policy was set to 'detect'. The analyst wants to prevent further execution of this file across the organization. What is the most efficient action?

   • AUse the 'Outbreak Control' feature to quarantine the file on all endpoints.
   • BUninstall the connector from affected endpoints and reinstall.
   • CCreate a custom detection for the file's SHA256 and apply it to all groups.
   • DChange the policy to 'block' for all unknown files.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company uses Cisco ESA with AMP for Content Security. They are experiencing a high number of false positives where legitimate emails are being quarantined because the attachments are unknown and later deemed malicious. The security team wants to reduce false positives while still maintaining protection. What should they do?

   • AAdd the sender's domain to the allow list in the ESA.
   • BDisable retrospective analysis for email.
   • CConfigure the ESA to only quarantine files with a 'malicious' disposition, not 'unknown'.
   • DLower the AMP threat score threshold for quarantine.
   Reveal Solution Discussion Select an answer first