What Does EPP Offer That EDR Does Not?

350-701 By islever Editorial Last updated

Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions

Short answer

C Sandboxing is offered by an EPP, which isolates and detonates suspect files in a safe environment before entry, while EDR covers detection, investigation, and response.

Question

What is offered by an EPP solution but not an EDR solution?
  1. investigation
  2. containment
  3. sandboxing Correct Answer
  4. detection

Key Takeaways

The question tests the Cisco-defined capability split between EPP and EDR, and the trap is assuming that any analysis-style behavior must belong to EDR rather than recognizing sandboxing as a prevention-stage EPP feature.

Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) overlap but divide responsibilities differently: EPP emphasizes prevention at the point of entry, while EDR emphasizes detection, investigation, and response after compromise. Cisco's own EPP documentation lists sandboxing as an EPP capability, which makes sandboxing the correct answer among investigation, containment, sandboxing, and detection.

Common mistake: Option A (investigation) is the most tempting wrong pick because it sounds advanced, but Cisco explicitly defines EDR as 'detection, investigation, and response.' Option B (containment) is likewise an EDR response function, and D (detection) is also a named EDR capability.

Expert Analysis

Why the Answer Is Correct

Cisco's Endpoint Protection Platform documentation describes sandboxing as an EPP capability in which the platform isolates suspect files into a safe environment and safely detonates and monitors them without risking the rest of the system. Sandboxing therefore sits at the prevention stage of the endpoint security lifecycle, which is exactly the EPP mission of stopping threats at the point of entry. The Cisco EPP-versus-EDR comparison material lists sandboxing under EPP's feature set alongside advanced anti-malware, machine learning, and threat intelligence. Because the question asks for a capability offered by EPP but not by EDR, sandboxing is the distinguishing item.

Why the Other Options Are Wrong

Cisco explicitly defines EDR as delivering detection, investigation, and response, so options A (investigation) and D (detection) are EDR functions, not exclusives of EPP. Containment (option B) is an EDR response action used to restrict an already-confirmed breach on the endpoint. Some learners note that modern EDR platforms can integrate with tools such as Cisco Secure Malware Analytics to detonate files, but on the exam's definitional level sandboxing is categorized as an EPP capability, so it remains the intended answer.

Community Comment Notes

Net4dd, Totosos1, cyberwhyzzi0 and XBfoundX all converge on C and cite Cisco's EPP-versus-EDR blog and the "What is an EPP" page. Totosos1 quoted the official wording that "Sandboxing. Sandboxing allows the endpoint protection platform to isolate suspect files into a safe environment." XBfoundX reinforced the exclusion logic by noting EDR covers "Detection, investigation, and response" while EPP is prevention at the point of entry. Tuxzinator dissented, arguing that "EDR can provide sandboxing through integrated Cisco Secure Malware Analytics," but that integration-based view does not override Cisco's categorical placement of sandboxing within EPP.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On 350-701 capability-comparison items, anchor yourself to Cisco's literal lifecycle labels: EPP is prevention at the point of entry; EDR is detection, investigation, and response after entry. When two options look like they could fit both, pick the one tied to pre-entry prevention (sandboxing, anti-malware, ML) for EPP.

Frequently Asked Questions

Why isn't detection the right answer, since EPP also detects malware?

Cisco formally labels detection as part of EDR's triad of detection, investigation, and response. EPP's advanced anti-malware does stop threats, but on the exam detection is attributed to EDR.

Can't EDR sandbox files through an integrated Cisco Secure Malware Analytics?

In practice EDR tools can integrate with Secure Malware Analytics for detonation, but Cisco's definitional classification lists sandboxing as an EPP capability, which is what the exam is testing.

More 350-701 FAQ →

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Net4dd 👍 4
    C is correct https://blogs.cisco.com/security/endpoint-protection-platform-epp-vs-endpoint-detection-response-edr
  2. Totosos1 👍 3 Answered C
    It's definitely C: https://www.cisco.com/c/en_uk/products/security/what-is-endpoint-protection-platform.html "Sandboxing. Sandboxing allows the endpoint protection platform to isolate suspect files into a safe environment. Within this environment, the endpoint protection platform can safely detonate and monitor the nature of the files without risking detriment to the rest of the system."
  3. sull3y 👍 2
    C:Sandboxing is a technique used in security solutions to isolate potentially malicious files or programs in a controlled environment, known as a sandbox. It allows these files to be executed or analyzed in a safe and isolated environment, without posing a risk to the actual system. This helps in detecting and analyzing suspicious behaviors or malware without compromising the integrity of the endpoint or network. EDR solutions typically focus on detection, investigation, and response to advanced threats, whereas sandboxing is a feature commonly found in EPP solutions that provide broader endpoint protection capabilities.
  4. cyberwhizzy0 👍 2
    The answer is C. Let's stop confusing readers, always back up your claims with appropriate URLs Sandboxing. Sandboxing allows the endpoint protection platform to isolate suspect files into a safe environment. Within this environment, the endpoint protection platform can safely detonate and monitor the nature of the files without risking detriment to the rest of the system https://www.cisco.com/c/en_uk/products/security/what-is-endpoint-protection-platform.html#~how-an-epp-works
  5. Tuxzinator 👍 1
    not C the investigative process, sandboxing is another critical capability. Sandboxing can be used at the perimeter, to help grant or deny access, but it can also be used effectively after the point of entry. Sandboxing is when the file is isolated into a simulated environment and tested and monitored. EDR can provide sandboxing through integrated Cisco Secure Malware Analytics. Sandboxing: Sandboxing allows an EPP to isolate suspect files in a safe environment. Within this environment, the EPP can safely detonate and monitor the nature of the files without risking detriment to the rest of the system.
Show 3 more comments
  1. XBfoundX 👍 1 Answered C
    Effective anti-malware protection is the most demanding of these capabilities, because malware can appear harmless at first and change behavior later. To counter that, a modern EPP uses advanced anti-malware techniques: Machine learning: Uses large-scale data to determine whether a file is malicious, including files it has not seen before. Threat intelligence: Draws on historical and real-time data from billions of threats to automatically block known attacks. Sandboxing: Isolates suspect files in a safe environment, then detonates and monitors them without risk to the rest of the system.
  2. XBfoundX 👍 1
    Also the answer cannot be D beacuse here are specified the EDR capabilities: EDR. Detection, investigation, and response EPP Prevention at the point of entry Search this keywords in the same link that I provived.
  3. XBfoundX 👍 1
    https://www.cisco.com/site/us/en/learn/topics/security/what-is-an-endpoint-protection-platform.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide