Endpoint Security
What this domain tests
Endpoint Security focuses on Cisco Secure Endpoint (formerly AMP for Endpoints), endpoint detection and response, and posture integration with Cisco ISE and AnyConnect. Questions probe verdict handling, isolation, retrospective detection, and indicators of compromise.
Core rules
- The connector sends file, process, and network telemetry to the cloud; verdicts are clean, malicious, or unknown, with unknown files submitted for analysis.
- Retrospective security re-evaluates prior verdicts; a file once judged clean can be quarantined later when intelligence changes.
- Device isolation restricts the host to the Secure Endpoint cloud, preserving the investigation channel while containing spread.
- Indicators of compromise can be simple (hash, domain, IP) or compound (process lineage plus network event) and can trigger quarantine or isolation.
- Exclusions improve performance but create blind spots; they should be narrow and justified.
- Posture assesses OS patches, antivirus, and required software before authorizing network access.
Worked example
A finance laptop runs a signed updater that writes to a temp directory and then beacons to a rare domain. The connector reports low prevalence, and no signature matches.
Reasoning: do not add an exclusion or whitelist the signer. Review the device trajectory to confirm parent-child process lineage and the outbound connection, then isolate the host if command-and-control is suspected. Submit the file for analysis and apply retrospective quarantine if it is later deemed malicious. Block the hash and domain at Secure Endpoint and Umbrella, and collect artifacts before remediation. Isolating first is reversible and keeps the connector channel open; deleting the file immediately destroys evidence and may tip off the attacker. A signature-only approach fails against polymorphic malware.
Traps that cost marks
- Low prevalence is not proof of malice, but it is a reason to investigate.
- Exclusions can silently disable protection on critical paths.
- Isolation is not full shutdown; management connectivity to the cloud must remain.
- Quarantine is reversible; deletion is not.
- An offline connector keeps its last policy and cannot receive new actions.
Key points
- Secure Endpoint verdicts are clean, malicious, or unknown, with cloud analysis for unknowns.
- Retrospective verdicts can quarantine files previously considered clean.
- Isolation limits the host to the Secure Endpoint cloud for investigation.
- IoCs can be simple or compound and can trigger automated actions.
- Exclusions create blind spots and must be narrow.
- Posture checks compliance before network authorization.