AMP for Endpoints Simple Custom Detection List Configuration

This answer is officially verified by Cisco.com documentation. According to the official Cisco configuration guide, "Configure a Simple Custom Detection List on the AMP for Endpoints Portal," the workflow and logic are defined as follows: 📖 Official Cisco Documentation Verification The Core Mechanism: Cisco's documentation states that the Simple Custom Detection list operates purely by identifying, matches, and quarantining files by their unique cryptographic signature. The Manual Steps: When configuring an entry, step-by-step instructions explicitly mandate adding the file's hash : "Step 4. On the Add SHA-256 option, paste the SHA-256 code previously collected from the specific file you want to block..." "Step 5. On the Upload File option... once the file is uploaded, the SHA-256 of this file is added into the list..." Exam/Definition Mapping: Industry-standard Cisco security exam blueprints (such as the CCNP Security 350-701 SCOR) define this explicitly: Question: "With AMP, what is meant by simple custom detection?" Answer: "It's a method for identifying and quarantining a specific file by its SHA-256." 💡 Summary of the Incident Behavior Because the security team originally uploaded a simple text-string filename (abc123456789xyz.exe) rather than the mathematical SHA-256 hash, the Cisco Secure Endpoint engine could not execute a signature-match during endpoint scans . To remediate the outbreak, the administrator must obtain the file's SHA-256 hash and upload it to the Simple Custom Detection List (Option C).

The malicious file was uploaded to a Simple Custom Detection list in the AMP for Endpoints Portal, so the AMP already calculated the SHA-256 hash, you don't need to do it again. Since the file is a .exe file, which means it is executable, you should block it from the application control list.

When they say “the file was uploaded” → that usually means the filename (not its hash) was added. Simple Custom Detection does not work with filenames. It only works with SHA-256 hashes. That’s why AMP isn’t detecting it — because AMP is looking for hashes, not file names.

You can add a file on SCB by either SHA or File Upload. When you are doing it through the file upload, the SHA field is populated automatically. No need to upload both. I will say that in real world. there is something to do with the Cache which did not expire yet but as this is not an option here, BACL is the most appropriate answer - so I will go with B

though every place i look it says c is the correct answer

here is the answer from the official cert guide Simple custom detection allows you to add file signatures, while the advanced custom ­detections are more like traditional antivirus signatures. Creating a simple custom detection is similar to adding new entries to a blacklist. You define one or more files that you are trying to quarantine by building a list of SHA-256 hashes. If you already have the SHA-256 hash of a file, you can paste that hash directly into the UI, or you can upload files directly and allow the cloud to create the SHA-256 hash for you. To create a simple custom detection, navigate to Outbreak Control > Custom Detections > Simple and the list of all existing simple custom detections appears, as shown in Figure 11-3. To add a new one, you must type it in the Name box and click Save, as shown in Figure 11-3.

Thus we all ready added it and thus the Hash was created and applied it to a policy, but failed to detect it. Thus it may fall outside our security policies. Thus it is not "C"" for it automatically generated the Hash and we already added the app to the simple custom detection list. Thus in this case we still cannot detect it after uploading it and applying it to policy to the simple custom detection list. The lack of detection is still a problem, as the application cant be blocked if not detected. We dont care about removing the app or the file. With the block list it will detect it and blocking it hence it is able to block the app from installing or executing. from the cert guide it says this.... AMP for Endpoints Application Control Like files, applications can be detected, blocked, and whitelisted. As with the other files, AMP does not look for the name of the application but the SHA-256 hash.

The custom detection list will accept files and hashes but is custom detection list, I vote C

yes this is a file but this is also a application which goes into the block lists.

Would have to vote C here. The main objective of this question is ...."what must be performed to ensure DETECTION of the malicious file?" While Option B does effectively BLOCK the execution of the file - it is also not the best suited choice for DETECTION purposes. Option C allows us to IDENTIFY and DETECT the file on systems in the network based on its unique hash value.

Correct answer C We can upload the SHA-256 hash of this file to the Simple Customer Detection List so that AMP for Endpoints can block it. Reference: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.pdf

reference question #239. Answer is that we need to explicitly add the file to block application list.

The answer cannot be C, since the question states "The malicious file was uploaded to a Simple Custom Detection list in the AMP for Endpoints Portal", so the AMP already calculated the SHA-256 hash, you don't need to do it again. Since the file is a .exe file, which means it is executable, you should block it from the application control list. Sorry for not posting a link, this was learned from practice.

C is the answer.

Wrongo