Discuss Cisco 350-701 Exam Topic 5 Question 131

[Endpoint Protection and Detection]

An engineer must configure Cisco AMP for Endpoints so that it contains a list of files that should not be executed by users. These files must not be quarantined. Which action meets this configuration requirement?

AIdentity the network IPs and place them in a blocked list.

BModify the advanced custom detection list to include these files.

CCreate an application control blocked applications list.

DAdd a list for simple custom detection.

Suggested Answer: C

create an application control blocked applications list. This option allows you to specify a list of files that you want to prevent from running on the endpoints that have the AMP connector installed. The files are identified by their SHA-256 hashes, and you can upload them individually or in a batch.The files are not quarantined, but they are blocked from execution and reported as events in the AMP console1.This option is different from the simple custom detection list, which is used to detect and quarantine specific files that are considered malicious2.The advanced custom detection list is also used to detect and quarantine files, but it allows you to specify more criteria such as file size, file name, and file path3.The IP block and allow lists are used to control the network traffic to and from the endpoints, not the file execution4.Reference:1:Configure Application Control on the AMP for Endpoints Portal2:Configure a Simple Custom Detection List on the AMP for Endpoints Portal3:

[Configure an Advanced Custom Detection List on the AMP for Endpoints Portal]4:

[Configure IP Block and Allow Lists on the AMP for Endpoints Portal]

Get Premium 350-701 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

3 comments · newest first

Micaela 4 days ago

I’m a bit confused about the difference between custom detection and application control. I want to say D could be relevant, but I’m not confident.

Yolando 9 days ago

I remember practicing a question similar to this, and I feel like creating a blocked applications list could be the right move. So maybe C?

Lorenza 14 days ago

I think the answer might be B, but I’m not entirely sure if that’s the right approach for preventing execution without quarantine.

Cisco 350-701 Exam - Topic 5 Question 131 Discussion