Which Cisco Secure Endpoint Feature Builds a Custom Detection File List to Quarantine Files?
What must be configured on Cisco Secure Endpoint to create a custom detection file list to detect and quarantine future files?
Community Insight
The exam tests whether you can distinguish Simple Custom Detection (exact SHA-256 file hashes for known, specific files) from Advanced Custom Detection (ClamAV signatures for variants and polymorphic malware) — the trap is swapping their underlying detection data.
Cisco Secure Endpoint offers two custom detection mechanisms, and only the Simple Custom Detection list is built by adding the exact SHA-256 hash of each known file so it is detected and quarantined. This page explains why that list, not Advanced Custom Detection or an application control or IP block list, satisfies the requirement.
Option A, because candidates remember that hashes are involved and assume the 'advanced' feature must be the one that accepts them; in reality Advanced Custom Detection takes ClamAV signatures (hex patterns, PE sections, regex), while hashes belong to Simple Custom Detection.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco Secure Endpoint's Simple Custom Detection list is exactly the construct for enumerating specific files you already know about: you add each file's SHA-256 hash to the list, and any endpoint that later encounters a file matching that hash is detected and the configured action (quarantine or block) is applied — which is precisely the "detect and quarantine future files" behavior in the stem. Cisco's own configuration guide for this feature is titled around creating a Simple Custom Detection list specifically to "detect, block and quarantine specific files." The wording of the question ("custom detection file list") and the per-file granularity both point to this feature rather than a signature-based or policy-based control.Why the Other Options Are Wrong
Option A confuses the two detection types: Advanced Custom Detection does not accept file hashes as its rule input; it is built on ClamAV signatures (hexadecimal patterns, PE sections, regular expressions) so it can catch file variants and polymorphic malware, which is a different use case. Option B is irrelevant — a network IP block/allow list governs network traffic destinations, not file execution or quarantine on endpoints. Option D is also a non-fit: application control allow lists govern which applications may run, and an allow list does not quarantine files; neither application control nor IP lists exist to hash-match arbitrary files.Community Comment Notes
Most of the thread converges on the simple list: as XBfoundX summarized, "with simple custom detection lists you are going to upload the SHA of file" and the match is quarantined, while Advanced Custom Detection exists for variants via ClamAV signatures — the same reasoning devildog and klu16 were weighing as A versus C. GongRoca pushed back with "SCD cannot quarantine a file, it can only allow, block and monitor", but that assertion is contradicted by the Cisco support document luismg and Surfside92 cited, which describes the Simple Custom Detection list as the way to detect, block and quarantine specific files. Premium_Pils repeatedly urged the thread to settle the dispute with vendor documentation rather than belief, which is the right instinct here.Exam Strategy
Memorize the pairing: Simple Custom Detection = exact SHA-256 hashes of known files (quarantine/block those exact files); Advanced Custom Detection = ClamAV signatures for variants and polymorphic malware. When a stem mentions a specific file list or hashes, choose the simple list without overthinking it.Official Reference
Exam Strategy
Anchor the two custom detection types in memory by their data type: hash = simple list, signature/pattern = advanced list. Questions about blocking a specific known file almost always map to the SHA-256-based Simple Custom Detection list, while questions about variants or polymorphic malware map to Advanced Custom Detection (ACD).
Frequently Asked Questions
Why can't I upload the file hash to Advanced Custom Detection (option A)?
Advanced Custom Detection rules are ClamAV signatures (hex patterns, PE sections, regex) built to catch variants; exact SHA-256 hash matching of known files is what Simple Custom Detection lists do.
Does a Simple Custom Detection list only alert, or can it quarantine?
It can act: Cisco's configuration guide for the Simple Custom Detection list describes using it to detect, block and quarantine the specific files whose hashes you uploaded.