Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessHard
A security engineer is configuring a Cisco Secure Endpoint (formerly AMP for Endpoints) deployment. The organization has strict requirements for blocking advanced threats, including polymorphic malware and fileless attacks, while minimizing false positives. Which protection engine within Cisco Secure Endpoint is primarily responsible for detecting these sophisticated threats using behavioral analysis and machine learning?
- ACloud IOC Engine
- BTetra Engine
- CExploit Prevention Engine
- DEthos Engine
Show answer & explanationAnswer & explanation
Correct answer: B. Tetra Engine
The Tetra Engine within Cisco Secure Endpoint uses machine learning and behavioral analysis to detect polymorphic and fileless malware, as well as other sophisticated threats that signature-based methods would miss, making it ideal for the described requirements.
Why the other options are wrong
- A. Cloud IOC (Indicators of Compromise) Engine correlates intelligence from the cloud, but Tetra is the primary behavioral engine.
- C. Exploit Prevention focuses on blocking techniques used by exploits, not specifically the malware itself via behavioral analysis.
- D. Ethos Engine is primarily for file reputation and cloud-based analysis of unknown files.
Cisco Secure Endpoint Engines
Cisco Secure Endpoint (formerly AMP for Endpoints) utilizes multiple detection engines to provide comprehensive protection against various types of threats.
- Combines signature, behavioral, and cloud-based analysis.
- Protects against known and unknown (zero-day) threats.
- Engines work in concert for multi-layered protection.
Memory trick: Each engine has a 'specialty' for fighting malware.