Implementing and Operating Cisco Security Core Technologies (SCOR 350-701) Practice Test

Answer: D
Explanation: EPP and EDR are two types of endpoint security solutions that have differentgoals and capabilities. EPP stands for endpoint protection platform, which is a suite oftechnologies that work together to prevent, detect, and remediate security threats onendpoints. EPP solutions use techniques such as antivirus, firewall, application control, andpatch management to block known and unknown malware and malicious activity. EDRstands for endpoint detection and response, which is a solution that provides real-timevisibility into endpoint activities and enables security teams to detect, investigate, andrespond to advanced threats that may have bypassed EPP defenses. EDR solutions usetechniques such as behavioral analysis, threat intelligence, and incident response to flagoffending files at the first sign of malicious behavior, contain and isolate compromisedendpoints, and remediate the damage caused by the attack. Therefore, the correct answeris D, as having an EDR solution gives an engineer the capability to flag offending files atthe first sign of malicious behavior. The other options are incorrect because: A is false, as EPP focuses primarily on threats that have evaded front-linedefenses that entered the environment, not EDR.B is false, as having an EPP solution allows an engineer to detect, investigate, andremediate modern threats, not EDR.C is false, as EDR focuses on detection and response at the endpoint level, notprevention at the perimeter. References:EPP vs. EDR: Why You Need Both - CrowdStrike

Answer: C,E
Explanation: A next-generation endpoint security solution is a modern approach ofcombining user and system behavior analytics with AI and machine learning to provideendpoint security12. These solutions are specifically designed to detect unknown malwareand zero-day threats, which other non-next-generation solutions might fail to detect3. Twokey deliverables that help justify the implementation of a next-generation endpoint securitysolution are: Continuous monitoring of all files that are located on connected endpoints. Thisfeature allows the solution to scan and analyze all files on the endpoints,regardless of their origin or type, and identify any malicious or suspiciousbehavior. This helps to prevent malware from infecting the endpoints or spreadingto other devices on the network4.

Answer: A
Explanation: Cisco CloudLock is a cloud-native cloud access security broker (CASB) that helps youmove to the cloud safely. It protects your cloud users, data, and apps. CloudLock’s simple,open, and automated approach uses APIs to manage the risks in your cloud appecosystem. With CloudLock you can more easily combat data breaches while meetingcompliance regulations1. Cisco CloudLock provides the following features that meet the requirements of visibility intodata transfers as well as protection against data exfiltration: User security: Cloudlock uses advanced machine learning algorithms to detectanomalies based on multiple factors. It also identifies activities outside allowedcountries and spots actions that seem to take place at impossible speeds acrossdistances1.Data security: Cloudlock’s data loss prevention (DLP) technology continuouslymonitors cloud environments to detect and secure sensitive information. Itprovides countless out-of-the-box policies as well as highly tunable custompolicies. It also supports inline and out-of-band data inspection and blockingcapabilities to protect sensitive data12.App security: The Cloudlock Apps Firewall discovers and controls cloud appsconnected to your corporate environment. You can see a crowd-sourcedCommunity Trust Rating for individual apps, and you can ban or allowlist thembased on risk1.The other solutions do not provide the same level of visibility and protection as CiscoCloudLock:  Cisco Umbrella is a cloud-delivered network security service that provides DNSlayer security, secure web gateway, cloud-delivered firewall, cloud access securitybroker, and threat intelligence3. It does not offer data security features such asDLP, data inspection, and data blocking4.Cisco AppDynamics Cloud Monitoring is a cloud-native application performancemanagement solution that helps you monitor, troubleshoot, and optimize yourcloud applications. It does not offer user security, data security, or app securityfeatures as a CASB solution.Cisco Stealthwatch is a network traffic analysis solution that provides visibility andthreat detection across your network, endpoints, and cloud. It does not offer datasecurity features such as DLP, data inspection, and data blocking.References: 3: Cisco Umbrella Packages - Cisco Umbrella 1: Cisco Cloudlock - Cisco 2:Cisco Cloudlock Cisco Cloudlock: Secure Cloud Data 4: Easy to Deploy & Simple toManage CASB Solution - Cisco Umbrella : Cisco AppDynamics Cloud Monitoring : CiscoStealthwatch - Cisco

Answer: B
Explanation: Simple Custom Detection is a feature of Cisco AMP for Endpoints that allowsadministrators to block specific files based on their SHA-256 or MD5 hashes. This feature can be used to detect and quarantine files of unknown disposition, such asabc424400664.zip, by adding their hashes to a custom list in the AMP portal. The list canthen be applied to a policy that is assigned to the endpoints. Simple Custom Detectionworks on files of any type, size, or platform, unlike the other options that are eitherplatform-specific (Android Custom Detection), size-limited (Blocked Application), orsignature-based (Advanced Custom Detection). References: 1, 2, 3

Answer: A
Explanation: Contextual awareness is the ability to collect and analyze information about the networkenvironment, such as users, devices, applications, threats, and vulnerabilities, and use it toenhance security policies and actions. Cisco Firepower is a network security device thatsupports contextual awareness by providing real-time visibility into network traffic andactivity, security intelligence from Cisco Talos and other sources, and advanced threatprotection with Cisco AMP and sandboxing. Cisco Firepower can also leverage CiscopxGrid to share contextual data with other security solutions, such as SIEM and TDplatforms, to enable faster and more accurate threat detection andresponse123 References := 1: Cisco Firepower NGIPS Data Sheet - Cisco 2: Cisco IdentityServices Engine with Integrated Security Information and Event Management and ThreatDefense Platforms At-a-Glance - Cisco 3: A Visibility-Driven Approach to Next-GenerationFirewalls