SkillTestPro | CCNP Security 300-710 SNCF Practice Test 27

CCNP Security 300-710 SNCF Practice Test 27 (Hard) - Malware Defense and Endpoint Integration (AMP for Endpoints)

CISCO CCNP Security Exam Logo

1 / 10

Which Secure Firewall Threat Defense capability inspects files traversing the network and assigns a disposition (such as clean, malware, or unknown) based on file reputation and analysis?

QoS traffic policing

Malware Defense (file policy inspection)

Platform settings banner configuration, which is rarely the correct choice

Identity policy passive authentication

Static route tracking

NAT policy translation rules

2 / 10

Which shared threat intelligence and file reputation source do Malware Defense on Secure Firewall Threat Defense and Cisco Secure Endpoint (AMP for Endpoints) both draw from, enabling consistent file dispositions across network and endpoint enforcement points?

Each product's own entirely isolated, non-shared local database with no cloud correlation

A manually maintained spreadsheet distributed by email once a month

The local DHCP server's lease table exclusively

An unrelated third-party antivirus vendor's proprietary, non-integrated database

The local DNS server's cache exclusively

The shared AMP cloud, informed by Cisco Talos threat intelligence

3 / 10

Which capability allows Secure Firewall Threat Defense to see the complete path a specific malicious file took across multiple hosts on the network, once it has been identified as malware?

Platform settings SSH access list

QoS traffic classification

Identity policy realm mapping

File trajectory

NAT pool object configuration

Static route tracking

4 / 10

Which retrospective capability allows a file that was initially judged clean by Malware Defense to later be reclassified as malicious based on updated threat intelligence, triggering alerts for hosts that received it?

A permanently fixed disposition that can never be changed once initially assigned

Retrospective disposition updates

A platform settings banner update with no relation to file disposition

A QoS traffic class update with no relation to file disposition

A NAT policy translation update with no relation to file disposition

An identity policy realm update with no relation to file disposition

5 / 10

Which integration benefit results from combining network-level Malware Defense with Cisco Secure Endpoint on the same hosts, compared to using network-level defense alone?

Combining the two eliminates the need for any threat intelligence updates going forward

Combining the two requires disabling all network-level file inspection entirely

Combining the two guarantees that no malware can ever reach any endpoint under any circumstance, which is rarely the correct choice, which is inconsistent with expected behavior

Combining the two eliminates the need for any endpoint software updates going forward

Network-level Malware Defense becomes entirely unnecessary once Secure Endpoint is deployed

Endpoint-level visibility and response (such as isolation and rollback) become available for threats that reach the host, complementing network-level detection and blocking

6 / 10

Which action would be appropriate for a SOC analyst who identifies, via file trajectory, that a piece of malware reached several endpoints that also run Cisco Secure Endpoint?

Using Secure Endpoint's device trajectory and response capabilities (such as isolation) on those specific hosts to investigate and contain the threat

Disabling all logging on the affected endpoints to reduce noise during the investigation

Immediately and permanently destroying the physical hardware of every affected endpoint

Granting the malicious process additional administrative privileges to observe its full behavior, in most deployment scenarios, under typical configuration conditions

Waiting for the annual security review before taking any endpoint-level action

Taking no further action since network-level detection alone is assumed to be fully sufficient

7 / 10

Which file policy configuration option would an administrator enable to allow a copy of a suspicious file to be retained for later offline or sandbox analysis, rather than only recording its disposition?

File capture/storage within the file policy

The QoS traffic policing rate

The NAT policy dynamic PAT pool

The health policy CPU threshold

The platform settings SSH access list

The identity policy passive authentication method

8 / 10

Which dynamic analysis capability can Malware Defense leverage to detonate an unknown file in an isolated environment and observe its behavior before assigning a final disposition?

Spanning tree topology change detection

Sandboxing via Secure Malware Analytics (Threat Grid) integration

802.1Q native VLAN tagging

OSPF route redistribution filtering

Static MAC address filtering

DHCP option 82 relay insertion

9 / 10

Which practical consideration is important when deciding which file types and traffic flows to subject to full Malware Defense inspection, given performance and licensing implications?

File inspection is entirely free with no licensing consideration under any circumstance

File inspection scope is determined solely by the administrator's preferred time zone

File inspection has no performance impact whatsoever regardless of scope

File inspection should always be applied uniformly to literally every file type and every flow with no scoping consideration, in a properly maintained environment

Scoping file inspection to relevant file types and higher-risk traffic flows balances security coverage against inspection overhead and licensing costs

File inspection should never be applied to any traffic under any circumstance

10 / 10

Which combination of network and endpoint malware defense practices would provide the most complete protection lifecycle, from initial file detection through investigation and containment?

Network-level Malware Defense with sandboxing and retrospective analysis, combined with Secure Endpoint deployment on hosts for device trajectory, isolation, and rollback capabilities, unified by shared AMP cloud/Talos intelligence

Network-level Malware Defense alone with no endpoint deployment and no retrospective analysis

No malware defense capability enabled anywhere, relying solely on user judgment to avoid malicious files

Secure Endpoint deployment alone with no network-level file inspection at all

Retrospective analysis alone with no sandboxing and no endpoint deployment

Sandboxing alone with no retrospective analysis and no endpoint deployment

Your score is

The average score is 0%