350-701 practice question 33 of 35

[Endpoint Protection and Detection] What does Cisco AMP for Endpoints use to help an organization detect different families of malware?

Domain Endpoint Protection and Detection

Answer options

A: Ethos Engine to perform fuzzy fingerprinting Correct answer

B: Tetra Engine to detect malware when me endpoint is connected to the cloud

C: Clam AV Engine to perform email scanning

D: Spero Engine with machine learning to perform dynamic analysis

Correct Answer:

A. Ethos Engine to perform fuzzy fingerprinting

Explanation

ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected.
Reference: https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdfETHOS = Fuzzy Fingerprinting using static/passive heuristics
Reference: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2016/pdf/BRKSEC-2139.pdf

Keep practicing

Take the free 350-701 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.