350-201 Question 105
Select 3A security analyst is tasked with deploying endpoint protection on all hosts within their organization to detect and mitigate malware threats. The analyst decides to use Cisco AMP for Endpoints. Which of the following capabilities provided by Cisco AMP for Endpoints are most relevant to ensuring host security?
- A
Real-time malware detection and blocking using global threat intelligence
- B
Network traffic segmentation to prevent lateral movement
- C
File trajectory tracking to analyze the lifecycle of malicious files
- D
Sandboxing capabilities to detonate suspicious files in a controlled environment
- E
DDoS attack mitigation using global scrubbing centers
Show answer and explanation
Correct answers: A, C, D
Explanation
Cisco AMP for Endpoints provides robust host security by focusing on malware detection, file trajectory tracking, and sandboxing capabilities. These features ensure that threats are identified, analyzed, and mitigated effectively at the host level. Other options like network segmentation or DDoS mitigation are not part of AMP's scope and are handled by different security solutions.
- A. Correct.
Real-time malware detection and blocking is a core feature of Cisco AMP for Endpoints, leveraging global threat intelligence to identify and stop threats on hosts.
- B. Incorrect.
Network traffic segmentation is not a feature of Cisco AMP for Endpoints. It is more relevant to network-based solutions like Cisco TrustSec.
- C. Correct.
File trajectory tracking allows Cisco AMP for Endpoints to provide visibility into the lifecycle and behavior of files on a host, helping analysts understand how threats propagate.
- D. Correct.
Sandboxing is a key feature of Cisco AMP for Endpoints, as it allows suspicious files to be analyzed in a controlled environment before they can harm the host.
- E. Incorrect.
DDoS attack mitigation is not a capability of Cisco AMP for Endpoints. This type of protection is typically handled by network-level solutions like Cisco Umbrella or Cisco Secure DDoS Protection.