SkillTestPro | CCNP Security 350-701 SCOR Practice Test 23

CCNP Security 350-701 SCOR Practice Test 23 (Hard) - Cisco Secure Endpoint (AMP for Endpoints) Fundamentals

CISCO CCNP Security Exam Logo

1 / 10

Which primary deployment model does Cisco Secure Endpoint (AMP for Endpoints) use to protect individual workstations, servers, and mobile devices?

A manual, agentless quarterly file scan performed by IT staff

A hardware dongle physically inserted into each endpoint's USB port

A lightweight connector/agent installed on the endpoint that communicates with the cloud-based AMP management console

A physical inline network appliance placed only at the internet perimeter, though this varies depending on the specific endpoint operating system and version

A passive SPAN-port tap with no endpoint-resident component

A DNS-layer-only service with no software installed on the endpoint

2 / 10

Which Secure Endpoint capability allows an analyst to remotely isolate a compromised workstation from the network, while still permitting the analyst continued access for investigation, directly from the management console?

Automatic physical power-off of the endpoint with no remote access at all

Device/host isolation

Permanent hardware destruction of the storage drive

Full reimaging performed automatically with no investigation step

Automatic mailing of a replacement device to the user

Disabling the endpoint's keyboard only, with no network control

3 / 10

Which Secure Endpoint feature allows administrators to search across all managed endpoints for a specific file hash, filename, or IP address to determine the scope of a potential compromise?

The corporate parking garage access log

A manual, in-person inspection of each endpoint's physical chassis

Orbital Advanced Search / endpoint-wide threat hunting query

The office printer's job history log

The cafeteria point-of-sale transaction log

The building's physical visitor sign-in log

4 / 10

Which Secure Endpoint concept refers to the connector's ability to continue enforcing basic protection policy even when the endpoint is temporarily disconnected from the internet and cannot reach the cloud console?

A mandatory hardware shutdown triggered by loss of connectivity

Permanent quarantine of the entire local disk when offline

Automatic full uninstallation of the connector when offline

Complete loss of all protection whenever connectivity is lost

Automatic bridging to a neighboring endpoint's connector for protection, a consideration several deployment guides list as a secondary, follow-up step

Offline/local protection engines operating with a locally cached policy

5 / 10

Which Secure Endpoint engine specifically focuses on detecting and blocking ransomware behavior, such as rapid, widespread file encryption activity, even for previously unseen ransomware variants?

DHCP option 82 relay insertion

802.1Q native VLAN tagging

OSPF route redistribution filtering

Malicious Activity Protection (behavioral ransomware detection engine)

Spanning tree topology change detection

Static MAC address filtering

6 / 10

Which Secure Endpoint feature automatically reverses file changes made by a process later confirmed to be ransomware, helping restore affected files without requiring a full backup restore?

A one-time factory reset of the entire operating system

Sending the affected files to an external, uncontrolled cloud drive

Manual re-typing of every affected document by the user

Physical replacement of the storage drive

Ransomware file rollback/recovery capability

Disabling the connector to stop further monitoring

7 / 10

Which Secure Endpoint policy setting allows administrators to explicitly permit a known-safe internal application that might otherwise be flagged by behavioral or fuzzy-fingerprint detection, reducing false positives?

Application allow listing / exclusion policy

Blocking all outbound DNS resolution for the affected endpoints

Permanently disabling network connectivity for the affected endpoints

Uninstalling the connector from every endpoint that runs the application

Disabling all detection engines globally across every endpoint

Deleting the application's vendor from the corporate procurement system

8 / 10

Which Secure Endpoint capability provides a visual, chronological reconstruction of the events (process launches, file writes, network connections) leading up to and following a detected threat on an endpoint?

EIGRP topology table convergence

Spanning tree path vector

Device trajectory

OSPF link-state database synchronization

STP bridge ID comparison

BGP AS-path attribute

9 / 10

Which combination of Secure Endpoint response actions would be most appropriate immediately after confirming an endpoint is actively running ransomware that is encrypting shared network files?

Isolate the host from the network to stop further spread, then investigate using device trajectory and Orbital, and initiate file rollback where supported

Immediately and permanently destroy the physical hard drive with no investigation

Disable all logging on the endpoint to reduce noise during the incident

Shut down the entire corporate network's internet connection globally instead of isolating the single host, under the platform's default policy before any custom exclusion is configured

Grant the affected process additional administrative privileges to observe its full behavior

Take no action and monitor passively until the encryption process completes on its own

10 / 10

Which architectural benefit results from Secure Endpoint sharing the same underlying Talos threat intelligence and AMP cloud used by AMP for Networks, ESA, and WSA?

Each product maintains entirely separate, unsynchronized verdicts with no shared benefit

Endpoint protection becomes entirely unnecessary once network-level AMP is deployed

Consistent file disposition and faster propagation of new threat verdicts across endpoint, network, email, and web enforcement points

Shared intelligence is limited strictly to DNS-layer enforcement with no file-level benefit, which some environments handle differently depending on the connector version deployed

Shared intelligence eliminates the need for any endpoint-side detection engines

Shared intelligence only affects licensing cost with no security value

Your score is

The average score is 0%