Endpoint Protection and Detection

Question 1

AMP solutions enables malware detection, blocking, continuos analaysis and retrospective views with the following features

Answer 1

• File reputation : amp allows you to analyze inline and block or apply policies
• File Sandboxing : AMP allows you to analyze unknown files to understand true file behavior
• File retrospection : Amp allows you to continue analyze files for changing threat levels

Question 2

Tools primarily focused on detecting and investigating suspicious activities other problems on host/endpoints.
It also monitor endpoints and network events and record the information in a central database so that you can perform further analysis, detection, investigation and reporting

Answer 2

EDR (Endpoint Detection and Response)

Question 3

The minimum capabilities of good EDR are?

Answer 3

• Filtering (ability to filter out false positive)
• Threat blocking (containing the threat)
• help with digital forensic and incident response (DFIR).

Question 4

Another term in the industry which people refer to same as EDR

Answer 4

EPP (Endpoint protection platform)

Question 5

Provides more than just endpoint-level visibility into files. It also provides cloud based detection of malware, in which the cloud constantly update itself.

Answer 5

AMP for Endpoints

Question 6

Amp cloud is able to provide a historical view of malware activity, segmented into two activity types

Answer 6

• File Trajectory : what endpoint have seen the files

- Device Trajectory : actions file performed on given endpoints

Question 7

Amp for Endpoint Connectors use this port to communicate with Cisco Cloud servers for file and network disposition lookups

Answer 7

TCP 443 by default or TCP 32137

Question 8

Allows you to create lists that customize AMP for Endpoints to your organizations needs.

Answer 8

Outbreak Control

Question 9

You can think of this as blacklist detection. When this detection is defined , not only endpoints quarantine matching files when they see them but any AMP for endpoints agents that have seen the files before this detection is created can also quarantine the files thru retrospection. also known as cloud recall.

-Allows you to add traditional antivirus signatures.

Answer 9

Custom Detection.

Question 10

Difference between simple and advance custom detection

Answer 10

Simple custom detection allows you to add file signatures
(Creating a simple custom detection is similar to adding new entries to blacklist, you define one or more files that you are trying to quarantine by building a list of SHA-256 hashes)

Advance custom detection are more like traditional antivirus signatures.

Question 11

Difference between simple and advance custom detection

Answer 11

-Simple custom detection just look for SHA-256 hash of a file.

-Advance custom detection include the following
>File body-based signatures
>MD5 Signatures,
>MD5, PE section based-signatures
>An extended signature format
>Logical signatures
>Icon signatures

Question 12

Allows you to flag or even block suspicious network activity. You can use policies to specify the behavior of AMP for endpoints when a suspicious connection is detected and also to specify whether connector should use address in Cisco Intelligence feed

Answer 12

DFC (device flow correlation)

Question 13

Allows you to block application. This does not look into the name of application but the SHA-256 hash. If you dont have SHA-256, you can upload one application at a time and have AMP cloud console calculate the SHA-256 hash. App must be not larger than 20MB

Answer 13

Application Control - Blocked Applications.

Question 14

A list of directories, file extensions or even threat names that you do not want the AMP agent to scan subsequently not convict as malware. You can use this to resolve conflict with other security products or mitigate performances issues by excluding directories that contain large file that are frequently written to like database

Answer 14

Exclusion Set

Question 15

Available exclusion type

Answer 15

• Threat (threat name)
• Extension (file extension)
• Wildcard (filenames, path , extension)
• Path (path)

Question 16

Amp for Endpoints is available for multiple platforms: Windows,Android,Mac,Linux. Where can you see the available connectors from the cloud console ?

Answer 16

Management > Download Connector>

Question 17

To create this , you navigate to Management > Policies. This is applied to an endpoint via groups.

Answer 17

AMP for Endpoint Policies

Question 18

You can use this to AnyConnect to aid in distribution of the AMP connector to client who use AnyConnect remote access VPN, secure network access, posture assessment with CIsco ISE.

Answer 18

AnyConnect AMP Enabler

Question 19

Three detection and protection engines in AMP for Endpoints

Answer 19

• TETRA (full client antivirus solution, do not enable if there is an existing antivirus. Default setting is TETRA Disabled as it changes AMP nature from lightweight to thick client that consumes more disk space).
• SPERO(machine-learning based technology that proactively identifies threats that were previously uknonwn. It active uses heuristic to gather execution attributes, and because the underlying algorithms come up with generic models)
• ETHOS (a “fuzzy fingerprinting” engine that uses static or passive heuristics)

Question 20

Provide MDM functionallity that ensures that diverse user equipment (mobile phones, tablet, laptop, and so on) is configured to a consistent standard and a supported set of application, functions or corporate policies

Answer 20

Cisco Meraki SM

Question 21

Is “one-pane-of-glass” console that automate integrations across Cisco Security products and threat intelligence sources. This is ongoing effort from Cisco to provide a single console for the management of most of its security products. Integrates with the following

• Cisco AMP
• Amp for Endpoints
• Cisco Threat Grid
• Cisco Umbrella
• Cisco Email Security
• Cisco Next-Generation Firewall (NGFW)
• Next-Generation Intrustion Prevention System (NGIPS)

Answer 21

Cisco Threat Response