Which is a Cisco solution feasures retrospective security?

Question

Options

• AAMP for Endpoint
• BCisco Defense Orchestrator
• CUmbrella
• DInvestigate

• A
  95% (38)
• B
  3% (1)
• C
  3% (1)

Explanation

AMP for Endpoints is correct because it features retrospective security - a unique capability that continuously monitors file behavior even after initial inspection. If a file is cleared at first but later identified as malicious (as threat intelligence updates), AMP retroactively detects, alerts, and can remediate the threat by tracing the file's trajectory through the environment.

Why the distractors are wrong:

• B. Cisco Defense Orchestrator is a cloud-based management platform for unifying firewall and security policy management - not a threat detection tool.
• C. Umbrella provides DNS-layer and cloud-delivered preventive security, blocking threats before connections are made - it's proactive, not retrospective.
• D. Investigate is a threat intelligence tool for researching domains, IPs, and malware relationships - useful for analysis, but not for retrospective endpoint protection.

Memory tip: Think of "AMP" as a security DVR - just like a DVR records everything so you can go back and review it, AMP records file activity so it can look back in time and catch threats that slipped through initially. "Retrospective" = looking backward, and AMP does exactly that.

No community discussion yet for this question.