Which Cisco AMP feature traces past file and process activity?
Which Cisco AMP feature allows an engineer to look back to trace past activities, such as file and process activity on an endpoint?
Community Insight
The question tests the specific AMP capability for retroactive endpoint tracing, and the trap is choosing a search or investigation console term that sounds similar but is not the look-back feature.
Cisco AMP retrospective security lets an engineer look back in time at historical file, process, and communication activity on an endpoint. This page confirms why retrospective security is the correct answer rather than endpoint isolation or a generic search/investigation feature.
Learners often pick advanced search or advanced investigation because those terms imply digging into past data, but Cisco AMP's named capability for looking back at file and process history is retrospective security.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco AMP's retrospective security is explicitly designed to look back in time and trace historical file, process, and communication activity on an endpoint. It continuously records endpoint telemetry so that when a file disposition changes or an indicator of compromise appears, the engineer can retrospectively scope the infection, establish root cause, and remediate. This is exactly the capability described by the question's wording about tracing past activities such as file and process activity. Therefore, retrospective security is the correct AMP feature.Why the Other Options Are Wrong
Endpoint isolation is a containment action that cuts a compromised endpoint off from the network; it does not provide historical tracing of file and process lineage. Advanced search can query recorded events, but it is an investigation interface rather than the named AMP capability for retroactive tracing after a disposition change. Advanced investigation similarly suggests analysis workflow, but it is not the Cisco AMP feature defined as looking back in time across endpoint activity. None of these options matches the specific retrospective tracing function described in the question.Community Comment Notes
Totosos1 selects B and quotes the AMP definition as the ability to "look back in time and trace processes, file activities, and communications" to understand an infection and establish root cause. XBfoundX also selects B and points to Cisco's AMP guide as supporting documentation. Both learners converge on retrospective security, and their comments reinforce the distinction between historical tracing and containment or generic search features. This community consensus aligns with the vendor definition and the question wording.Official Reference
Exam Strategy
Anchor on the phrase "look back" or "trace past activities" and map it directly to retrospective security in Cisco AMP/Secure Endpoint. Eliminate isolation immediately because it is a containment action, and treat search/investigation options as interfaces rather than the historical-tracing feature.
Frequently Asked Questions
Why is advanced search not the Cisco AMP feature for looking back at past activity?
Advanced search queries recorded events, but retrospective security is the specific AMP capability that applies new intelligence to historical file and process activity for root-cause analysis and remediation.
What does endpoint isolation do in Cisco AMP?
It contains a compromised endpoint by cutting off its network access; it does not provide historical tracing of file and process lineage.