350-201 Question 160
Select 4A security analyst is troubleshooting an existing detection rule in Cisco Secure Endpoint (formerly AMP for Endpoints). The rule is designed to alert on unauthorized file modifications in critical directories, but it is not triggering as expected. Which of the following steps should the analyst take to identify and resolve the issue?
- A
Verify that the rule is applied to the correct group of endpoints.
- B
Check if the detection rule’s logic matches the intended behavior and conditions.
- C
Ensure that the endpoints have the latest version of the endpoint security agent installed.
- D
Review the endpoint logs to determine if the suspicious activity is occurring.
- E
Disable the rule temporarily and observe if the system behaves as expected.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To troubleshoot detection rule issues in Cisco Secure Endpoint, the analyst should ensure that the rule is applied to the correct endpoints, the rule logic aligns with the intended detection behavior, the endpoint agents are up-to-date, and logs are reviewed to confirm whether the activity is occurring. Disabling the rule is not a diagnostic step and could impact security monitoring.
- A. Correct.
Correct. If the rule is not applied to the correct group of endpoints, it will not trigger on the desired devices. This is a fundamental troubleshooting step.
- B. Correct.
Correct. Misconfigured rule logic can prevent the detection rule from matching the intended activity, so verifying the logic is crucial.
- C. Correct.
Correct. If the endpoint security agent is outdated, it may not correctly enforce detection rules, leading to issues with rule triggers.
- D. Correct.
Correct. Reviewing endpoint logs helps determine whether the suspicious activity is actually occurring and if the rule should have triggered.
- E. Incorrect.
Incorrect. Disabling the rule temporarily does not aid in identifying the root cause of why the rule is not triggering. This step is not recommended in this scenario.