An engineer is configuring AMP for endpoints and wants to block certain files from executing. Which outbreak control method is used to accomplish this task?

Device flow correlation is typically related to network visibility and anomaly detection, not direct file execution blocking on endpoints.

Simple detections refer to basic threat identification, not a proactive method for blocking specific files from running.

The application blocking list (or Custom Blocking List) in Cisco AMP for Endpoints allows administrators to specify file hashes or characteristics of applications that should be prevented from executing on protected endpoints. This method provides direct control over what applications are permitted or denied, serving as an effective outbreak control measure.

Advanced custom detections (like custom indicators) are more for identifying complex or unknown threats, not for simply blocking known files from executing.