Exam 350-701 topic 1 question 239 discussion

I thought it's B like some guys said, but it's C for sure... From AMP for Endpoints User Guide, chapter 2: Outbreak Control: An application blocking list is composed of files that you do not want to allow users to execute but do not want to quarantine. You may want to use this for files you are not sure are malware, unauthorized applications, or you may want to use this to stop applications with vulnerabilities from executing until a patch has been released. B also is incorrect, because it says "simple detections" but actually it's called simple custom detections (like in answer D, but it's another function which allows the customer to write his own antivirus definitions...). I am 100% sure it's an answer C here :)

C. Application Blocking List

It's C

C is good. Outbreak control: Achieve control over suspicious files or outbreaks and remediate an infection without waiting for a content update. Within the outbreak control feature: ◦ Simple custom detections can quickly block a specific file across all or selected systems ◦ Advanced custom signatures can block families of polymorphic malware ◦ Application blocking lists can enforce application policies or contain a compromised application being used as a malware gateway and stop the reinfection cycle ◦ Custom whitelists will help ensure that safe, custom, or mission-critical applications continue to run no matter what ◦ Device flow correlation will stop malware call-back communications at the source, especially for remote endpoints outside the corporate network

Would go with C here.

Would go with C Application Block Lists are only applicable to binaries. When the SHA-256 of a binary is added to the Application Block List, AMP will prevent that file from being executed.

C. it is

The correct answer is B. https://www.connection.com/~/media/pdfs/brands/c/cisco/cisco-security-amp-solution-overview.pdf?la=en

For me the answer is B A Simple Custom Detection list is similar to a blocked list. These are files that you want to detect and quarantine. Not only will an entry in a Simple Custom Detection list quarantine future files, but through Retrospective it will quarantine instances of the file on any endpoints in your organization that the service has already seen it on.

I would answer D in this case, as custom detection blocks specific files, while application control is used to block application