350-201 Question 48
Single answerYour organization has recently deployed Cisco Secure Endpoint (formerly AMP) across all endpoints. As part of the incident response process, you need to isolate a machine that is showing signs of compromise without completely disconnecting it from the network. Which technique should you leverage to achieve this?
- A
Quarantine the affected file on the endpoint.
- B
Enable device isolation using Cisco Secure Endpoint.
- C
Perform a forensic snapshot of the endpoint.
- D
Block the malicious domain using Cisco Umbrella.
Show answer and explanation
Correct answer: B
Explanation
Enabling device isolation using Cisco Secure Endpoint is the correct technique to isolate a potentially compromised machine without fully disconnecting it from the management console. This approach ensures that the endpoint cannot interact with the rest of the network, reducing the risk of lateral movement or further compromise, while still allowing security administrators to investigate and resolve the issue.
- A. Incorrect.
Quarantining the affected file only isolates the specific file, not the entire machine, and does not stop potential lateral movement or ongoing communication with malicious actors.
- B. Correct.
Enabling device isolation using Cisco Secure Endpoint ensures the affected machine is isolated from the rest of the network while retaining limited communication with the management console for further investigation.
- C. Incorrect.
Performing a forensic snapshot is useful for evidence collection and analysis but does not isolate the compromised machine from the network.
- D. Incorrect.
Blocking the malicious domain using Cisco Umbrella can prevent communication with the malicious actor but does not isolate the compromised endpoint from the rest of the network.