Endpoint-Based Security for Password-Protected Archives

Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions

Answer Correct answer: D — Endpoint security is the solution for inspecting password-protected archives because network devices cannot parse the contents without the user's password, which is only available at the endpoint.

In which scenario is endpoint-based security the solution?

inspecting encrypted traffic
device profiling and authorization
performing signature-based application control
inspecting a password-protected archive Correct Answer

Community Votes

68%

12%

20%

68% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the distinction between network-based inspection and endpoint-based execution context; the common trap is assuming network decryption (ETA) solves all traffic inspection needs, ignoring local file operations.

This question examines the unique capabilities of endpoint security compared to network controls, specifically focusing on the inability of network devices to inspect password-protected archives. It establishes that endpoint protection is required when sensitive data resides in encrypted containers that only the endpoint can decrypt.

Many learners select A (inspecting encrypted traffic), believing that because endpoints can decrypt SSL/TLS, they are superior for encryption. However, network firewalls also perform this via ETA, making it not exclusive to endpoints, whereas password-protected archives inside files are a local access problem.

Community Discussion (19 comments)

XBfoundX 👍 1 Selected: D

A network firewall cannot inspect a password-protected archive because it lacks the user's password. Once the user enters the password and extracts the archive locally, a kernel-level endpoint driver (like Cisco Secure Endpoint) instantly intercepts the file write operation on disk, scanning the unencrypted contents before execution. This makes endpoint security the only possible solution.

7d4c29f 👍 1 Selected: D

Signature-based application control (C) is specifically a network-based security function performed by NGFWs and IPS solutions that inspect and control application traffic at the network level before it reaches endpoints. It does not require endpoint security because the network device handles all signature matching and control. Only password-protected archives (D) require endpoint security because they cannot be inspected at the network layer.

CyberGhost666 👍 1 Selected: D

D is correct.

kloug 👍 1

Answer c

Abu_Muhammad 👍 1 Selected: D

Thanks DWizard Excellent illustration.

4pelos 👍 1

Correct answer D. Checked in securitytut

petestudies 👍 1 Selected: C

I like C, application control the key I would for endpoint protection.

fdl543 👍 1 Selected: C

C Performing signature-based application control (executable hash used to block application). Inspect traffic is not endpoint. Devide profiling and authorization is ISE. Inspect a password-protected archive is not AMP funcion.

DWizard 👍 5 Selected: D

The answer is D. B is nonsense, A can be done at the network level (ETA, SSL decrytion) so you don't need an endpoint solution for that, and C can also be achieved by an IPS, so again, you don't need an endpoint solution, but if a malicious file is zipped and password-protected, it will bypass most of the security controls, only an endpoint protection solution will detect it and stop it at the moment of execution.

jku2cya 👍 1 Selected: D

Thought C initially, but agree with bigblob that it's actually D per their reasoning. Pretty sure there are always new IPS signature updates on FTD, and FTD is not an endpoint-based security solution.

Bandito 👍 2 Selected: A

Based on Cisco SCOR materials I choose A: Because HIPS is installed directly on the host that it is protecting, it can monitor processes and resources on the system. It can also analyze encrypted traffic after it has been decrypted, which is something a network-based IPS cannot do.

dawlims 👍 4 Selected: C

https://blogs.cisco.com/security/endpoint-protection-platform-epp-vs-endpoint-detection-response-edr#:~:text=Cisco%20AMP%20for%20Endpoints%20goes,block%20malware%20in%20real%2Dtime.

davezz 👍 1

Did some googling, it seems EDR and XDR can't inspect password protected files, so based on this D isn't correct as it's impossible to execute D.

Martian89 👍 2 Selected: C

Think its C in AMP saves the hash of the app You upload and can block

west33637 👍 5 Selected: A

Im going with A. Endpoint protection cannot open a password protected archive. Endpoint protection does not do signature based application control. you can create application block lists and allow lists using file hashes, but no signature based application control that Im aware of. Inspecting encrypted files can be done at the network level, but it is not optimal. it consumes way too much firewall CPU and can be impractical. Also, some encrypted sites implement certificate pinning and client side validation and therefore network decryption will appear as a man in the middle and fail. Endpoint protection is the recommended solution for inspecting encrypted traffic.

Joseph47 👍 2

what about when the user enters the password for the protected file? then AMP would ask for its hash, isn't? (Hope so)

Emlia1 👍 2 Selected: C

C I prefer

bigblob 👍 7 Selected: D

A, B and C can be done at the network level. Only for password-protected (=encrypted?) archive, there is not enough information on the network level, so it needs to be done on the end point.

davezz 👍 2

application control (C) can't be done at the network level

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option D is the correct answer because a password-protected archive (such as a ZIP with a password) cannot be inspected by network security appliances (firewalls, IPS) without the password. The network device sees only ciphertext and cannot parse the internal structure. Endpoint security solutions operate at the OS level; once the user enters the password locally to extract or open the file, the endpoint agent (e.g., Cisco Secure Endpoint/AMP) intercepts the file write or execution event, scans the decrypted content, and enforces policy. This scenario represents a gap in network visibility that only an endpoint solution can fill.

Why the Other Options Are Wrong

Option A (inspecting encrypted traffic) is incorrect because network firewalls commonly perform Encrypted Traffic Analytics (ETA) or SSL/TLS decryption to inspect traffic, so this is not a unique use case for endpoint security. Option B (device profiling) is primarily a function of Network Access Control (NAC) platforms like Cisco ISE, which profile devices based on network behavior and certificates, though endpoints assist, the authorization decision is often network-centric. Option C (signature-based application control) is a core capability of Intrusion Prevention Systems (IPS) and firewalls, which use signatures to block malicious applications regardless of whether they are on the endpoint or traversing the network.

Community Comment Notes

Community consensus strongly favors Option D. As user 'bigblob' noted, "A, B and C can be done at the network level," highlighting that the other options do not exclusively require endpoint presence. User 'XBfoundX' provided a detailed technical explanation: "A network firewall cannot inspect a password-protected archive... Once the user enters the password... a kernel-level endpoint driver... instantly intercepts the file write operation." This aligns with the principle that endpoints handle local file integrity and access control where network boundaries cease to provide visibility.

Exam Strategy

When analyzing security solutions, always ask: 'Can the network see this?' If the data is encrypted locally (like a password-protected zip) or requires user credentials to access, the network likely cannot inspect it effectively. In such cases, the endpoint is the necessary enforcement point.

Frequently Asked Questions

Why can't firewalls inspect password-protected archives?

Firewalls see only encrypted bytes. Without the password, they cannot unzip or read the internal files, making network inspection impossible until the file is decrypted locally by the endpoint.

Does endpoint security replace network IPS for application control?

No. Network IPS handles signature-based application control (Option C) for traffic in transit. Endpoints complement this by handling local execution and file integrity after decryption.

More 350-701 FAQ →

Related Analysis

← Back to 350-701 Study Guide