Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessHard
A managed security service provider (MSSP) is offering a new service to protect client endpoints from a wide range of threats, including malware, ransomware, and fileless attacks. The service must include advanced detection capabilities, the ability to contain threats, and a forensic investigation console. Which Cisco Secure Endpoint feature provides a centralized view and control over these advanced detection and response capabilities across all managed endpoints?
- AMalware Analytics (Threat Grid)
- BExploit Prevention
- CDevice Trajectory
- DEndpoint Console
Show answer & explanationAnswer & explanation
Correct answer: D. Endpoint Console
The Cisco Secure Endpoint (formerly AMP for Endpoints) Endpoint Console is the centralized management interface where all detection, response, and forensic capabilities are accessed and controlled. It provides the overall visibility, allows for policy configuration, incident investigation (including Device Trajectory and Malware Analytics), and remediation actions across all protected endpoints.
Why the other options are wrong
- A. Malware Analytics (Threat Grid) is a specific detection and analysis engine, not the overarching console.
- B. Exploit Prevention is a specific engine/capability, not the centralized management console.
- C. Device Trajectory is a specific forensic feature within the console, tracking endpoint activity over time, not the console itself.
Cisco Secure Endpoint Console
The centralized web-based management interface for Cisco Secure Endpoint, providing comprehensive visibility, control, and access to all endpoint security features, detection engines, response actions, and forensic tools.
- Centralized management for all endpoints.
- Access to all detection and response features.
- Used for policy configuration, incident investigation, and remediation.
Memory trick: The Endpoint Console is the 'Cockpit' for flying your Secure Endpoint fleet.