Exam 350-401 topic 1 question 877 discussion

A. detect and block ransomware in email attachments - ESA B. outbound URL analysis and data transfer controls - FirePOWER & FireSIGHT C. user context analysis - NetFlow & StealthWatch D. blocking of fileless malware in real time - AMP for Endpoints (one of the features of AMP - "The exploit prevention feature will defend endpoints from exploit-based, memory injection attacks." - where fileless malware is malicious code that works directly within a computer's memory. https://www.cisco.com/c/dam/en/us/td/docs/security/network_security/ctd/ctd2-0/design_guides/ctd_2-0_cvd_guide_jul15.pdf https://www.cisco.com/c/en/us/products/collateral/security/fireamp-endpoints/datasheet-c78-733181.html

Cisco Threat Defense architecture emphasizes endpoint security → Fileless malware & Real-time blocking (Cisco AMP for Endpoints)

D is correct

D is correct

D is the correct answer.

Given answer is correct

I think correct is C https://www.cisco.com/c/dam/en/us/td/docs/security/network_security/ctd/ctd2-0/design_guides/ctd_2-0_cvd_guide_jul15.pdf

Cisco AMP for Endpoints provides file-matching analysis to identify suspicious files when they are transferred onto an endpoint. AMP can provide automated blocking of suspicious files as well as the ability to track the spread of a file throughout the network using a feature known as File Trajectory