Which Cisco Secure Endpoint Feature Builds a Custom Detection File List to Quarantine Files?

350-701 By islever Editorial Last updated

Configure endpoint antimalware protection using Cisco Secure Endpoint Interpret Cisco Secure Endpoint malware detection events

Short answer

C Use a Simple Custom Detection list in Cisco Secure Endpoint, adding each file's SHA-256 hash so matching files are detected and quarantined.

Question

What must be configured on Cisco Secure Endpoint to create a custom detection file list to detect and quarantine future files?
  1. Create an advanced custom detection and upload the hash of each file.
  2. Add a network IP block allowed list to the configuration and add the blocked files.
  3. Use the simple custom detection feature and add each detection to the list. Correct Answer
  4. Configure an application control allowed applications list to block the files.

Key Takeaways

The exam tests whether you can distinguish Simple Custom Detection (exact SHA-256 file hashes for known, specific files) from Advanced Custom Detection (ClamAV signatures for variants and polymorphic malware) — the trap is swapping their underlying detection data.

Cisco Secure Endpoint offers two custom detection mechanisms, and only the Simple Custom Detection list is built by adding the exact SHA-256 hash of each known file so it is detected and quarantined. This page explains why that list, not Advanced Custom Detection or an application control or IP block list, satisfies the requirement.

Common mistake: Option A, because candidates remember that hashes are involved and assume the 'advanced' feature must be the one that accepts them; in reality Advanced Custom Detection takes ClamAV signatures (hex patterns, PE sections, regex), while hashes belong to Simple Custom Detection.

Expert Analysis

Why the Answer Is Correct

Cisco Secure Endpoint's Simple Custom Detection list is exactly the construct for enumerating specific files you already know about: you add each file's SHA-256 hash to the list, and any endpoint that later encounters a file matching that hash is detected and the configured action (quarantine or block) is applied — which is precisely the "detect and quarantine future files" behavior in the stem. Cisco's own configuration guide for this feature is titled around creating a Simple Custom Detection list specifically to "detect, block and quarantine specific files." The wording of the question ("custom detection file list") and the per-file granularity both point to this feature rather than a signature-based or policy-based control.

Why the Other Options Are Wrong

Option A confuses the two detection types: Advanced Custom Detection does not accept file hashes as its rule input; it is built on ClamAV signatures (hexadecimal patterns, PE sections, regular expressions) so it can catch file variants and polymorphic malware, which is a different use case. Option B is irrelevant — a network IP block/allow list governs network traffic destinations, not file execution or quarantine on endpoints. Option D is also a non-fit: application control allow lists govern which applications may run, and an allow list does not quarantine files; neither application control nor IP lists exist to hash-match arbitrary files.

Community Comment Notes

Most of the thread converges on the simple list: as XBfoundX summarized, "with simple custom detection lists you are going to upload the SHA of file" and the match is quarantined, while Advanced Custom Detection exists for variants via ClamAV signatures — the same reasoning devildog and klu16 were weighing as A versus C. GongRoca pushed back with "SCD cannot quarantine a file, it can only allow, block and monitor", but that assertion is contradicted by the Cisco support document luismg and Surfside92 cited, which describes the Simple Custom Detection list as the way to detect, block and quarantine specific files. Premium_Pils repeatedly urged the thread to settle the dispute with vendor documentation rather than belief, which is the right instinct here.

Exam Strategy

Memorize the pairing: Simple Custom Detection = exact SHA-256 hashes of known files (quarantine/block those exact files); Advanced Custom Detection = ClamAV signatures for variants and polymorphic malware. When a stem mentions a specific file list or hashes, choose the simple list without overthinking it.

Official Reference

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Anchor the two custom detection types in memory by their data type: hash = simple list, signature/pattern = advanced list. Questions about blocking a specific known file almost always map to the SHA-256-based Simple Custom Detection list, while questions about variants or polymorphic malware map to Advanced Custom Detection (ACD).

Frequently Asked Questions

Why can't I upload the file hash to Advanced Custom Detection (option A)?

Advanced Custom Detection rules are ClamAV signatures (hex patterns, PE sections, regex) built to catch variants; exact SHA-256 hash matching of known files is what Simple Custom Detection lists do.

Does a Simple Custom Detection list only alert, or can it quarantine?

It can act: Cisco's configuration guide for the Simple Custom Detection list describes using it to detect, block and quarantine the specific files whose hashes you uploaded.

More 350-701 FAQ →

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. luismg 👍 3 Answered C
    C with wimple should work https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.html
  2. Premium_Pils 👍 3
    Please avoid leaving a comment with a weak answer.
  3. GongRoca 👍 2
    SCD cannot quarantine a file, it can only allow, block and monitor. In this case the answer is A ACD (Advance custom detection).
  4. devildog 👍 2 Answered A
    I believe this is A.
  5. XBfoundX 👍 1 Answered C
    Answer is C, with simple custom detection lists you are going to upload the SHA of file and is going to be put in quarantine, once detected. Advanced Custom Detection Lists are used to quarantine file variants or polymorphic malware based on ClamAV signatures (hexadecimal patterns, PE sections, regular expressions). When a file matches an ACD rule, it is treated as a threat and quarantined.
Show 5 more comments
  1. Premium_Pils 👍 1
    The funny thing is that this site does not save all my comments. I don't know what's the logic, which comments get published and which ones don't. Surely, they do not publish all, even with relevant content.
  2. Premium_Pils 👍 1
    Belief against facts. Please, read through some corresponding Cisco documents before leaving an answer. It is actually C. (see why in the previous comment)
  3. Surfside92 👍 1
    Correct C This document describes the steps to create a Simple Custom Detection list to detect, block and quarantine specific files
  4. klu16 👍 1
    I'm not sure. Either A or C, for sure NOT D.
  5. Zikosheka 👍 1 Answered C
    im going with C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide