A company is experiencing an increase in phishing attacks where users are tricked into downloading malicious documents (e.g., weaponized PDFs or Microsoft Office files) from legitimate-looking websites. The existing content security solutions include a Secure Web Gateway (SWG) and an Email Security Gateway (ESG). To specifically address this threat, which additional content security technology would provide the most effective layer of defense against these types of attacks delivered via web downloads?
- ANetwork Access Control (NAC) to restrict user access.
- BData Loss Prevention (DLP) for outbound data.
- CIntrusion Prevention System (IPS) for network perimeter.
- DAdvanced Malware Protection (AMP) for Endpoints.
Show answer & explanationAnswer & explanation
Correct answer: D. Advanced Malware Protection (AMP) for Endpoints.
Advanced Malware Protection (AMP) for Endpoints (now Cisco Secure Endpoint) is designed to detect, prevent, and respond to advanced malware, including weaponized documents, at the endpoint level. It uses continuous monitoring, behavioral analysis, and threat intelligence to identify and remediate threats that may bypass perimeter defenses or SWGs/ESGs, making it highly effective against these types of attacks.
Why the other options are wrong
- A. NAC restricts network access, but doesn't directly prevent or detect malicious documents once a user is authorized.
- B. DLP focuses on preventing sensitive data from leaving the organization, not detecting inbound malicious documents.
- C. IPS primarily detects and prevents network-based exploits and attack signatures, not necessarily the content of downloaded files after they bypass initial web filters.
AMP for Endpoints (Cisco Secure Endpoint)
An endpoint security solution that provides comprehensive protection against advanced malware, including detection, prevention, and response capabilities, using continuous monitoring and behavioral analysis.
- Protects against file-based malware, ransomware, and zero-day threats.
- Uses a combination of signatures, behavioral analysis, and cloud intelligence.
- Provides visibility into file trajectory and retrospective security.
Memory trick: AMP on Endpoints: Attacks Measured, Protected Precisely.