How Do You Quarantine Future Files in Cisco Secure Endpoint?
What must be configured on Cisco Secure Endpoint to create a custom detection file list to detect and quarantine future files?
Community Votes
80% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the distinction between Simple and Advanced Custom Detections in Cisco Secure Endpoint; the trap is assuming only Advanced Custom Detections can quarantine, when a Simple Custom Detection file list supports quarantine for hash-listed files.
Cisco Secure Endpoint's Simple Custom Detections feature lets you create a hash-based file list with a quarantine action to handle future files. This page establishes that option C—using the simple custom detection feature and adding each detection—is the correct configuration for this scenario.
Selecting A (Advanced Custom Detection) because it sounds more powerful, even though the question calls for a simple custom detection file list with quarantine action.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco Secure Endpoint provides two custom detection mechanisms: Simple Custom Detections and Advanced Custom Detections. The question asks for a "custom detection file list" that can "detect and quarantine" future files, which is exactly what a Simple Custom Detection list does—you upload SHA-256 hashes and choose a protection action such as Quarantine, Block, or Monitor. Cisco's own configuration document, "Configure a Simple Custom Detection List," describes this workflow. Therefore option C correctly specifies the feature to use. The community majority (80 votes for C) and luismg's shared Cisco link reinforce this pairing.Why the Other Options Are Wrong
Option A is tempting because Advanced Custom Detections sound more robust, but they are designed for complex IOC-based logic combining file, network, process, and registry indicators—not for simply uploading a list of file hashes to quarantine. Option B is irrelevant because a network IP block allowed list operates at the network layer and has nothing to do with file-hash detection or quarantine. Option D is also incorrect; application control allowed application lists manage execution by application identity, not by a custom file list that detects and quarantines future files. None of these options match the Simple Custom Detection file-list workflow described in the question.Community Comment Notes
As luismg noted while sharing the Cisco documentation, "C with wimple should work," and the vote tally strongly favors C. GongRoca argued that Simple Custom Detections cannot quarantine and chose A instead, claiming the feature only allows, blocks, or monitors—but Cisco's Simple Custom Detection list explicitly supports a quarantine action. klu16 was unsure between A and C but stated "for sure NOT D." Zikosheka simply went with C, and devildog picked A. Weighing the feature definitions against the question's "file list" and "quarantine" wording, the Simple Custom Detection feature is the intended answer.Official Reference
Exam Strategy
Memorize the two custom detection types: Simple for hash lists (quarantine/block/monitor) and Advanced for complex IOC logic. When the stem says 'file list' and 'quarantine,' pick Simple Custom Detections; don't overthink into advanced detections.
Frequently Asked Questions
Why is Advanced Custom Detection (A) wrong for a file list that quarantines files?
Advanced Custom Detections are for complex IOC logic, not for uploading a simple list of file hashes and setting quarantine; that is what Simple Custom Detections do.
Can Simple Custom Detections quarantine files, or only block and monitor?
Yes, Simple Custom Detections support a quarantine action; you upload SHA-256 hashes and choose Quarantine, Block, or Monitor/Audit as the protection action.