- (Exam Topic 5)
An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?

1. A. client applications by user, web applications, and user connections
2. B. number of attacked machines, sources of the attack, and traffic patterns
3. C. intrusion events, host connections, and user sessions
4. D. threat detections over time and application protocols transferring malware

Correct Answer: C

- (Exam Topic 5)
An engineer is reviewing a ticket that requests to allow traffic for some devices that must connect to a server over 8699/udp. The request mentions only one IP address, 172.16.18.15, but the requestor asked for the engineer to open the port for all machines that have been trying to connect to it over the last week. Which action must the engineer take to troubleshoot this issue?

1. A. Use the context explorer to see the application blocks by protocol.
2. B. Use the context explorer to see the destination port blocks
3. C. Filter the connection events by the source port 8699/udp.
4. D. Filter the connection events by the destination port 8699/udp.

Correct Answer: D

- (Exam Topic 5)
A network engineer is logged into the Cisco AMP for Endpoints console and sees a malicious verdict for an identified SHA-256 hash. Which configuration is needed to mitigate this threat?

1. A. Add the hash to the simple custom deletion list.
2. B. Use regular expressions to block the malicious file.
3. C. Enable a personal firewall in the infected endpoint.
4. D. Add the hash from the infected endpoint to the network block list.

Correct Answer: A

- (Exam Topic 1)
Which interface type allows packets to be dropped?

1. A. passive
2. B. inline
3. C. ERSPAN
4. D. TAP

Correct Answer: B
Reference:
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200908-configuring-firepower- threat-defense-int.html

- (Exam Topic 5)
An organization must be able to ingest NetFlow traffic from their Cisco FTD device to Cisco Stealthwatch for behavioral analysis. What must be configured on the Cisco FTD to meet this requirement?

1. A. flexconfig object for NetFlow
2. B. interface object to export NetFlow
3. C. security intelligence object for NetFlow
4. D. variable set object for NetFlow

Correct Answer: A