Exam 300-710 topic 1 question 212 discussion

I am not sure, but C looks fine. Quarantine endpoints is the job of ISE. https://www.cisco.com/c/ja_jp/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23-1_chapter_01101.html# ID173.

Looks like its C https://www.cisco.com/c/m/en_uk/products/security/identity-services-engine/use-case-threat-containment.html

"This integration allows you to create content policies on FMC based on the information that is shared by ISE and their published topics (related to the endpoint activity)." https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-32/220856-configure-and-troubleshoot-ise-3-2-with.html

It's see look at page 16 here- https://www.cisco.com/c/dam/m/en_uk/events/2016/securityexperts/pdf/rapid_threat_containment_sept_8th_2016.pdf

ISE instructs FMC

Should be A. Cisco ISE instructs Cisco AMP to contain the infected endpoint. When Cisco ISE detects an infected endpoint, it can instruct Cisco AMP to take actions directly on that specific endpoint to contain the threat. Given the specific keyword "endpoint," the scenario where Cisco ISE instructs Cisco AMP to contain the infected endpoint is more directly relevant and specific choice.

RTC w/ FMC & ISE is the ability for the FMC to quarantine end points through ISE. So, when the FMC sees some indicators of compromise, certain Snort IPS signatures are fired, or malware is discovered through AMP, the FMC can trigger actions to occur through ISE. ISE, in turn, can determine what to do when that trigger occurs.

ONLY C is the right answer, because ISE has the power to shut down the port in the case of Infected host

When an infected endpoint is identified in the network, the RTC (Rapid Threat Containment) workflow involves isolating the endpoint to prevent further spread of the threat. In this workflow, Cisco ISE (Identity Services Engine) identifies the infected endpoint and instructs Cisco FMC (Firepower Management Center) to contain the endpoint. Cisco FMC then applies the appropriate policy to contain the endpoint, such as isolating it on a separate VLAN or blocking its traffic altogether. Note that Cisco AMP (Advanced Malware Protection) can also play a role in threat containment, but in this specific RTC workflow, the instruction to contain the endpoint comes from Cisco ISE and is executed by Cisco FMC.

RTC w/ FMC & ISE is the ability for the FMC to quarantine end points through ISE. So, when the FMC sees some indicators of compromise, certain Snort IPS signatures are fired, or malware is discovered through AMP, the FMC can trigger actions to occur through ISE. ISE, in turn, can determine what to do when that trigger occurs. ISE could kick the user off the network or change the context of the user and endpoint so that different actions are taken within the network infrastructure.

RTC w/ FMC & ISE is the ability for the FMC to quarantine end points through ISE. So, when the FMC sees some indicators of compromise, certain Snort IPS signatures are fired, or malware is discovered through AMP, the FMC can trigger actions to occur through ISE. ISE, in turn, can determine what to do when that trigger occurs. ISE could kick the user off the network or change the context of the user and endpoint so that different actions are taken within the network infrastructure.

I think C

Ok, I wrote at 206 that this has to be right for it to be FMC and Stealthwatch. Upon further research I think AMP and Stealthwatch (aka AMP for Networks) are the only ones able to contain an Endpoint in case of Files and Malware. (Not any other case!!)