Exam 350-701 topic 1 question 476 discussion

an infection spreading accross network

C. an infection spreading across the network Endpoint is isolated, which means it is preventing it from spreading to other devices.

C is Correct: Endpoint Isolation is a feature that lets you block incoming and outgoing network activity on a Windows computer to prevent threats such as data exfiltration and malware propagation. https://cloudmanaged.ca/wp-content/uploads/2020/05/AMP-for-Endpoints-User-Guide.pdf This helps the infection not spreading to other endpoints on the network.

The question asks about 'endpoint isolation' specifically. I'd say that has more to do C i.e. "spreading across the network" as opposed to B "spreading across the user device".

It is an easy one. C. If an endpoint is infected, you isolate it from the rest of the network to avoid propagation, the endpoint itself is already infected so B is not correct. You also can check this out: https://www.cisco.com/c/en/us/support/docs/security/secure-endpoint/218064-troubleshoot-secure-endpoint-stuck-in-is.html#:~:text=Endpoint%20isolation%20is%20a%20feature,data%20exfiltration%20and%20malware%20propagation.

C. an infection spreading across the network When an endpoint is identified as compromised or infected with malware, endpoint isolation isolates the infected endpoint from the network to prevent the infection from spreading to other devices or systems. By isolating the infected endpoint, it helps contain the threat and prevents lateral movement of the malware within the network. This helps in minimizing the impact of the infection and allows security teams to investigate and remediate the compromised endpoint effectively.

C isolation stops all network except communications to amp cloud for malware analysis

The answer should be C.

When it says isolation, the question is isolation from what? If the user endpoint is infected by malware, it is done. The following action isolates the endpoint to prevent malware from spreading to others via the network.

Isolation isolates an endpoint from the network, to avoid a spread to other endpoints. Answer is C

C is correct.

C is correct: Endpoint isolation is a feature that lets you block incoming and outgoing network activity on a Windows computer to prevent threats such as data exfiltration and malware propagation. It is available on 64-bit versions of Windows that support version 7.0.5 and later of the connector.

B is correct

The answer should have been B.

Why C? should be option B, cisco AMP is Endpoint isolation is a feature that is specifically focused on preventing the spread of malware on an infected endpoint.