Exam 350-701 topic 1 question 626 discussion

Its Answer C, Answer D is more covered by a EPP

EDR leverages machine learning capabilities. (AMP, which is Ciscos'EDR. uses the threat intelligence of cisco talos.) "In addition to continuous file analysis, it is important to note that EDR is only as good at detecting files as the threat intelligence that powers it. This intelligence leverages large-scale data, machine learning capabilities, and advanced file analysis to help detect threats." https://www.cisco.com/c/en/us/products/security/endpoint-security/what-is-endpoint-detection-response-edr-medr.html#~edr-capabilities

preventing attacks by identifying harmful events with machine learning and conduct-based defense

AMP does not perform machine learning on the device, the answer is C

securitytut says this is D.