nerdexam
Cisco

700-765 · Question #132

How do AMP's device trajectory capabilities help address customers' breach remediation issues?

The correct answer is D. It determines the scope and cause of an outbreak and tracks suspicious files. Cisco AMP's Device Trajectory feature helps with breach remediation by identifying the scope of an outbreak and tracking how suspicious files moved across a device over time.

Cisco Security Product Solutions

Question

How do AMP's device trajectory capabilities help address customers' breach remediation issues?

Options

  • AIt tracks file behavior across the network to see which devices it enters and exits
  • BIt analyzes the data from suspicious files to provide a new level of threat intelligence
  • CIt searches for potential threats based on identified activities and behaviors
  • DIt determines the scope and cause of an outbreak and tracks suspicious files

How the community answered

(39 responses)
  • A
    10% (4)
  • B
    5% (2)
  • C
    3% (1)
  • D
    82% (32)

Why each option

Cisco AMP's Device Trajectory feature helps with breach remediation by identifying the scope of an outbreak and tracking how suspicious files moved across a device over time.

AIt tracks file behavior across the network to see which devices it enters and exits

Tracking files as they enter and exit multiple devices across the network describes AMP's File Trajectory feature, not Device Trajectory, which is scoped to a single device's activity timeline.

BIt analyzes the data from suspicious files to provide a new level of threat intelligence

Analyzing suspicious file data to produce new threat intelligence is a function of AMP's cloud threat intelligence engine and ThreatGrid integration, not Device Trajectory.

CIt searches for potential threats based on identified activities and behaviors

Searching for threats based on identified behaviors describes AMP's retrospective security and Indicators of Compromise (IoC) scanning capabilities, not the specific purpose of Device Trajectory.

DIt determines the scope and cause of an outbreak and tracks suspicious filesCorrect

AMP Device Trajectory records a continuous timeline of all file activities, process executions, and network connections on a specific device, enabling security teams to determine the root cause and full scope of an infection. This retrospective data allows analysts to trace the exact path of a threat, pinpointing patient zero and understanding what the malware did after execution.

Concept tested: Cisco AMP Device Trajectory breach remediation function

Source: https://www.cisco.com/c/en/us/products/security/amp-for-endpoints/index.html

Topics

#AMP#device trajectory#breach remediation#malware scope tracking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 700-765 Practice