- (Exam Topic 3)
What is a difference between Cisco AMP for Endpoints and Cisco Umbrella?

1. A. Cisco AMP for Endpoints is a cloud-based service, and Cisco Umbrella is not.
2. B. Cisco AMP for Endpoints prevents connections to malicious destinations, and C malware.
3. C. Cisco AMP for Endpoints automatically researches indicators of compromise ..
4. D. Cisco AMP for Endpoints prevents, detects, and responds to attacks before and against Internet threats.

Correct Answer: D
https://learn-umbrella.cisco.com/i/802005-umbrella-security-report/3? https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html#:~:text=Powe Cisco Advanced Malware Protection (AMP) for endpoints can be seen as a replacement for the traditional antivirus solution. It is a next generation, cloud delivered endpoint protection platform (EPP), and advanced endpoint detection and response (EDR). Providing Protection – Detection Response
While Cisco Umbrella can enforce security at the DNS-, IP-, and HTTP/S-layer, this report does not require that blocking is enabled and only monitors your DNS activity. Any malicious domains requested and IPs resolved are indicators of compromise (IOC).
Any malicious domains requested and IPs resolved are indicators of compromise IO( C)

- (Exam Topic 3)
Which portion of the network do EPP solutions solely focus on and EDR solutions do not?

1. A. server farm
2. B. perimeter
3. C. core
4. D. East-West gateways

Correct Answer: B

- (Exam Topic 3)
What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

1. A. lf four log in attempts fail in 100 seconds, wait for 60 seconds to next log in prompt.
2. B. After four unsuccessful log in attempts, the line is blocked for 100 seconds and only permit IP addresses are permitted in ACL
3. C. After four unsuccessful log in attempts, the line is blocked for 60 seconds and only permit IP addresses are permitted in ACL1
4. D. If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

Correct Answer: D

- (Exam Topic 3)
An administrator configures a new destination list in Cisco Umbrella so that the organization can block specific domains for its devices. What should be done to ensure that all subdomains of domain.com are blocked?

1. A. Configure the *.com address in the block list.
2. B. Configure the *.domain.com address in the block list
3. C. Configure the *.domain.com address in the block list
4. D. Configure the domain.com address in the block list

Correct Answer: C

- (Exam Topic 2)
Using Cisco Firepower’s Security Intelligence policies, upon which two criteria is Firepower block based? (Choose two)

1. A. URLs
2. B. protocol IDs
3. C. IP addresses
4. D. MAC addresses
5. E. port numbers

Correct Answer: AC
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-configguide-v623/secu