350-401 exam dumps

350-401 practice question 294 of 631

Implementing Cisco Enterprise Network Core Technologies. Professional level, Cisco. Free question with the correct answer and a full explanation.

350-401 Question 294

Select 3

A network administrator is tasked with implementing endpoint security to reduce the risk of malware and unauthorized access in the enterprise network. The organization uses Cisco AMP for Endpoints. Which two actions should the administrator perform to enhance endpoint security using Cisco AMP for Endpoints?

  1. A

    Enable file reputation to detect and block malicious files in real-time.

  2. B

    Configure endpoint devices to bypass Cisco AMP scanning during high CPU usage.

  3. C

    Integrate Cisco AMP for Endpoints with Cisco Threat Grid for advanced malware analysis.

  4. D

    Disable real-time protection to improve endpoint performance.

  5. E

    Use AMP connectors to monitor and report endpoint activity.

Show answer and explanation

Correct answers: A, C, E

Explanation

Cisco AMP for Endpoints is designed to provide robust endpoint security by detecting, blocking, and analyzing threats. Enabling file reputation ensures real-time protection against malicious files. Integrating with Cisco Threat Grid enhances threat detection capabilities by enabling malware analysis. AMP connectors play a key role in monitoring endpoint activity and providing actionable insights to administrators. Disabling real-time protection or bypassing scanning would compromise the organization's security posture, making these options incorrect.

  • A. Correct.

    Enabling file reputation is one of the key functions of Cisco AMP for Endpoints to detect and block malicious files in real-time, enhancing endpoint security.

  • B. Incorrect.

    Bypassing Cisco AMP scanning during high CPU usage would reduce endpoint security as it creates a vulnerability for potential threats.

  • C. Correct.

    Integration with Cisco Threat Grid allows for advanced malware analysis, improving the organization's ability to detect and respond to sophisticated attacks.

  • D. Incorrect.

    Disabling real-time protection compromises endpoint security, making the system vulnerable to threats.

  • E. Correct.

    AMP connectors are critical for monitoring and reporting endpoint activity, helping administrators identify and respond to potential risks.

Timed practice exam

Take a 350-401 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam