Which action must be taken in the AMP for Endpoints console to detect specific MD5 signatures on endpoints and then quarantine the files?

In Cisco AMP for Endpoints, an advanced custom detection list allows administrators to define specific file hashes (like MD5) that should be identified as malicious, enabling the system to detect and quarantine those files on endpoints.

An IP Block & Allow custom detection list is used to block or allow network connections based on IP addresses, not to detect file hashes.

An application custom detection list is typically used for managing the execution of specific applications based on their properties, not primarily for detecting arbitrary file hashes.

While a 'simple' custom detection list might exist for basic file blocking, the term 'advanced' specifically implies the capability to use hashes like MD5 for precise file detection and quarantine within AMP for Endpoints.