How Do You Quarantine Future Files in Cisco Secure Endpoint?

350-701 By islever Editorial Last updated

Short answer

C Use the Simple Custom Detection feature and add each file detection to the list so Cisco Secure Endpoint can quarantine future files.

Question

What must be configured on Cisco Secure Endpoint to create a custom detection file list to detect and quarantine future files?
  1. Create an advanced custom detection and upload the hash of each file.
  2. Add a network IP block allowed list to the configuration and add the blocked files.
  3. Use the simple custom detection feature and add each detection to the list. Correct Answer
  4. Configure an application control allowed applications list to block the files.

Key Takeaways

Tests the distinction between Simple and Advanced Custom Detections in Cisco Secure Endpoint; the trap is assuming only Advanced Custom Detections can quarantine, when a Simple Custom Detection file list supports quarantine for hash-listed files.

Cisco Secure Endpoint's Simple Custom Detections feature lets you create a hash-based file list with a quarantine action to handle future files. This page establishes that option C—using the simple custom detection feature and adding each detection—is the correct configuration for this scenario.

Common mistake: Selecting A (Advanced Custom Detection) because it sounds more powerful, even though the question calls for a simple custom detection file list with quarantine action.

Expert Analysis

Why the Answer Is Correct

Cisco Secure Endpoint provides two custom detection mechanisms: Simple Custom Detections and Advanced Custom Detections. The question asks for a "custom detection file list" that can "detect and quarantine" future files, which is exactly what a Simple Custom Detection list does—you upload SHA-256 hashes and choose a protection action such as Quarantine, Block, or Monitor. Cisco's own configuration document, "Configure a Simple Custom Detection List," describes this workflow. Therefore option C correctly specifies the feature to use. The community majority (80 votes for C) and luismg's shared Cisco link reinforce this pairing.

Why the Other Options Are Wrong

Option A is tempting because Advanced Custom Detections sound more robust, but they are designed for complex IOC-based logic combining file, network, process, and registry indicators—not for simply uploading a list of file hashes to quarantine. Option B is irrelevant because a network IP block allowed list operates at the network layer and has nothing to do with file-hash detection or quarantine. Option D is also incorrect; application control allowed application lists manage execution by application identity, not by a custom file list that detects and quarantines future files. None of these options match the Simple Custom Detection file-list workflow described in the question.

Community Comment Notes

As luismg noted while sharing the Cisco documentation, "C with wimple should work," and the vote tally strongly favors C. GongRoca argued that Simple Custom Detections cannot quarantine and chose A instead, claiming the feature only allows, blocks, or monitors—but Cisco's Simple Custom Detection list explicitly supports a quarantine action. klu16 was unsure between A and C but stated "for sure NOT D." Zikosheka simply went with C, and devildog picked A. Weighing the feature definitions against the question's "file list" and "quarantine" wording, the Simple Custom Detection feature is the intended answer.

Official Reference

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the two custom detection types: Simple for hash lists (quarantine/block/monitor) and Advanced for complex IOC logic. When the stem says 'file list' and 'quarantine,' pick Simple Custom Detections; don't overthink into advanced detections.

Frequently Asked Questions

Why is Advanced Custom Detection (A) wrong for a file list that quarantines files?

Advanced Custom Detections are for complex IOC logic, not for uploading a simple list of file hashes and setting quarantine; that is what Simple Custom Detections do.

Can Simple Custom Detections quarantine files, or only block and monitor?

Yes, Simple Custom Detections support a quarantine action; you upload SHA-256 hashes and choose Quarantine, Block, or Monitor/Audit as the protection action.

More 350-701 FAQ →

Community Votes

C
80%
A
20%

80% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. luismg 👍 3 Answered C
    C with wimple should work https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.html
  2. GongRoca 👍 1
    SCD cannot quarantine a file, it can only allow, block and monitor. In this case the answer is A ACD (Advance custom detection).
  3. klu16 👍 1
    I'm not sure. Either A or C, for sure NOT D.
  4. devildog 👍 1 Answered A
    I believe this is A.
  5. Zikosheka 👍 1 Answered C
    im going with C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide