nerdexam
Cisco

300-710 · Question #132

A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?

The correct answer is A. Add the hash to the simple custom deletion list. To mitigate a threat identified by a malicious SHA-256 hash in Cisco Secure Endpoint, the hash should be added to the Simple Custom Detection List to automatically delete or quarantine the file on endpoints.

Configuration

Question

A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?

Options

  • AAdd the hash to the simple custom deletion list.
  • BUse regular expressions to block the malicious file.
  • CEnable a personal firewall in the infected endpoint.
  • DAdd the hash from the infected endpoint to the network block list.

How the community answered

(28 responses)
  • A
    79% (22)
  • B
    7% (2)
  • C
    4% (1)
  • D
    11% (3)

Why each option

To mitigate a threat identified by a malicious SHA-256 hash in Cisco Secure Endpoint, the hash should be added to the Simple Custom Detection List to automatically delete or quarantine the file on endpoints.

AAdd the hash to the simple custom deletion list.Correct

In Cisco Secure Endpoint (formerly AMP for Endpoints), the 'Simple Custom Detection List' allows administrators to add specific SHA-256 hashes of known malicious files. When a file with a hash matching an entry on this list is detected, Secure Endpoint will automatically delete or quarantine it according to the policy.

BUse regular expressions to block the malicious file.

Regular expressions are typically used for pattern matching in filenames or paths, not for directly blocking specific files based on their SHA-256 hash.

CEnable a personal firewall in the infected endpoint.

Enabling a personal firewall controls network connections but does not directly mitigate a malicious file already identified on an endpoint by its hash.

DAdd the hash from the infected endpoint to the network block list.

Network block lists typically operate on IP addresses or domains to prevent network connections, not on file hashes to prevent file execution or presence on an endpoint.

Concept tested: Cisco Secure Endpoint custom file detection by hash

Source: https://docs.amp.cisco.com/SecureEndpointCustomDetectionsUserGuide.pdf

Topics

#Cisco AMP for Endpoints#Endpoint Security#Threat Mitigation#Custom Detections

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-710 Practice