What Does EPP Offer That EDR Does Not?
What is offered by an EPP solution but not an EDR solution?
Community Insight
The question tests the Cisco-defined capability split between EPP and EDR, and the trap is assuming that any analysis-style behavior must belong to EDR rather than recognizing sandboxing as a prevention-stage EPP feature.
Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) overlap but divide responsibilities differently: EPP emphasizes prevention at the point of entry, while EDR emphasizes detection, investigation, and response after compromise. Cisco's own EPP documentation lists sandboxing as an EPP capability, which makes sandboxing the correct answer among investigation, containment, sandboxing, and detection.
Option A (investigation) is the most tempting wrong pick because it sounds advanced, but Cisco explicitly defines EDR as 'detection, investigation, and response.' Option B (containment) is likewise an EDR response function, and D (detection) is also a named EDR capability.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco's Endpoint Protection Platform documentation describes sandboxing as an EPP capability in which the platform isolates suspect files into a safe environment and safely detonates and monitors them without risking the rest of the system. Sandboxing therefore sits at the prevention stage of the endpoint security lifecycle, which is exactly the EPP mission of stopping threats at the point of entry. The Cisco EPP-versus-EDR comparison material lists sandboxing under EPP's feature set alongside advanced anti-malware, machine learning, and threat intelligence. Because the question asks for a capability offered by EPP but not by EDR, sandboxing is the distinguishing item.Why the Other Options Are Wrong
Cisco explicitly defines EDR as delivering detection, investigation, and response, so options A (investigation) and D (detection) are EDR functions, not exclusives of EPP. Containment (option B) is an EDR response action used to restrict an already-confirmed breach on the endpoint. Some learners note that modern EDR platforms can integrate with tools such as Cisco Secure Malware Analytics to detonate files, but on the exam's definitional level sandboxing is categorized as an EPP capability, so it remains the intended answer.Community Comment Notes
Net4dd, Totosos1, cyberwhyzzi0 and XBfoundX all converge on C and cite Cisco's EPP-versus-EDR blog and the "What is an EPP" page. Totosos1 quoted the official wording that "Sandboxing. Sandboxing allows the endpoint protection platform to isolate suspect files into a safe environment." XBfoundX reinforced the exclusion logic by noting EDR covers "Detection, investigation, and response" while EPP is prevention at the point of entry. Tuxzinator dissented, arguing that "EDR can provide sandboxing through integrated Cisco Secure Malware Analytics," but that integration-based view does not override Cisco's categorical placement of sandboxing within EPP.Official Reference
Exam Strategy
On 350-701 capability-comparison items, anchor yourself to Cisco's literal lifecycle labels: EPP is prevention at the point of entry; EDR is detection, investigation, and response after entry. When two options look like they could fit both, pick the one tied to pre-entry prevention (sandboxing, anti-malware, ML) for EPP.
Frequently Asked Questions
Why isn't detection the right answer, since EPP also detects malware?
Cisco formally labels detection as part of EDR's triad of detection, investigation, and response. EPP's advanced anti-malware does stop threats, but on the exam detection is attributed to EDR.
Can't EDR sandbox files through an integrated Cisco Secure Malware Analytics?
In practice EDR tools can integrate with Secure Malware Analytics for detonation, but Cisco's definitional classification lists sandboxing as an EPP capability, which is what the exam is testing.