Question 1

If a file's SHA-256 hash is sent to the cloud, but the cloud has never seen the hash before, which disposition is returned?

Accepted Answer

If the cloud has never seen the hash before, it cannot determine if the file is clean or malware, so it returns a neutral disposition.

Question 2

The FireAMP connector supports which proxy type?

Accepted Answer

The FireAMP connector supports HTTP_proxy type.

Question 3

Which statement describes an advantage of cloud-based detection?

Accepted Answer

Cloud-based detection requires fewer resources on the endpoint because the heavy lifting of analysis and detection is done in the cloud, reducing the need for powerful hardware on the endpoint itself.

Question 4

What is the default clean disposition cache setting?

Accepted Answer

The default clean disposition cache setting is 604800 seconds, which is equivalent to 7 days.

Question 5

The FireAMP connector monitors the system for which type of activity?

Accepted Answer

The FireAMP connector primarily monitors file operations to detect and prevent malware and other malicious activities on the system.

Question 6

What do policies enable you to do?

Accepted Answer

The answer of What do policies enable you to do?
...

Question 7

When discussing the FireAMP product, which term does the acronym DFC represent?

Accepted Answer

DFC stands for Device Flow Correlation, which is a term associated with the FireAMP product, used for analyzing and correlating device flow data to detect threats.

Question 8

The FireAMP Mobile endpoint connector currently supports which mobile OS device?

Accepted Answer

The FireAMP Mobile endpoint connector supports Android devices.

Question 9

File information is sent to the Sourcefire Collective Security Intelligence Cloud using which format?

Accepted Answer

The Sourcefire Collective Security Intelligence Cloud uses the SHA-256 format to send file information for security analysis.

Question 10

How does application blocking enhance security?

Accepted Answer

Application blocking enhances security by preventing vulnerable applications from running until they are patched, reducing the risk of exploitation.

Question 11

Custom whitelists are used for which purpose?

Accepted Answer

Custom whitelists are used to specify which files to ignore, allowing certain files to bypass security checks or alerts.

Question 12

Which option is a detection technology that is used by FireAMP?

Accepted Answer

FireAMP uses fuzzy matching as a detection technology to identify and analyze potential threats.

Question 13

Advanced custom signatures are written using which type of syntax?

Accepted Answer

The answer of Advanced custom signatures are written using which...

Question 14

What is a valid data source for DFC Windows connector policy configuration?

Accepted Answer

Custom and Sourcefire are valid data sources for DFC Windows connector policy configuration.

Question 15

Which statement describes an advantage of the FireAMP product?

Accepted Answer

FireAMP provides enterprise visibility by allowing organizations to see and manage threats across their entire network, offering insights into potential security issues.

Question 16

Which disposition can be returned in response to a malware cloud lookup?

Accepted Answer

The answer of Which disposition can be returned in response...

Question 17

Which set of actions would you take to create a simple custom detection?

Accepted Answer

To create a simple custom detection, you can add a SHA-256 value, upload a file to calculate its SHA-256 value, or upload a text file containing SHA-256 values. These actions are directly related to identifying files based on their hash values.

Question 18

Which feature allows retrospective detection?

Accepted Answer

The answer of Which feature allows retrospective detection?
...

Question 19

Which hosts merit special consideration for crafting a policy?

Accepted Answer

Domain controllers are critical for network security and management, thus requiring special consideration in policy crafting.

Question 20

The Update Window allows you to perform which action?

Accepted Answer

The Update Window is used to specify a timeframe when an upgrade can be started and stopped, allowing for controlled and scheduled updates.

Exam 47: Designing Cisco Unified Contact Center Enterprise (UCCED)