Chapter 5 of 6 · Cisco CCNP 350-701 SCOR

Endpoint Protection and Detection

EPP, EDR, device management, posture, Secure Client, Secure Endpoint and email defense.

  • 5topics
  • 23 minfast track
  • 15%of the exam
Start with Endpoint Protection Platforms and Endpoint Detection and Response

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Endpoint Protection Platforms and Endpoint Detection and ResponseCompare endpoint protection platforms and EDR: prevention engines, continuous telemetry, investigation, response actions, XDR and…4 min
  2. 2Endpoint Management, Asset Inventory and Posture AssessmentUnderstand MDM and asset inventory systems and how posture assessment checks endpoint health, including ISE posture, compliance…4 min
  3. 3Cisco Secure Client and Cisco Secure Malware AnalyticsDescribe Cisco Secure Client modules for VPN, access, posture and visibility, and how Secure Malware Analytics runs files in a…5 min
  4. 4Configuring Cisco Secure Endpoint and Interpreting Detection EventsConfigure Cisco Secure Endpoint groups, policies, exclusions and custom detections, and interpret detection events, dispositions…5 min
  5. 5Email Security with Cisco Secure Email Threat DefenseLearn SPF, DKIM and DMARC, gateway filtering, and how Cisco Secure Email Threat Defense detects and remediates email threats…5 min

About this chapter

What this chapter covers

Endpoint Protection and Detection is about the devices where users work and where most attacks finally land.

It starts with the concepts of prevention and detection, then covers how devices are managed and checked. It then looks at Cisco Secure Client, malware analysis, Cisco Secure Endpoint and the protection of email.

The pages follow the seven topics that the question bank uses for this chapter. Product settings change between releases, so the pages teach the ideas and the order of tasks.

How the topics fit together

A well protected endpoint is known, healthy, monitored and able to be investigated.

Managed deviceMDM and inventorychecked byPosturehealthy or notprotected byEPP and EDRprevent and detectanalysed bySandboxMalware AnalyticsEmailthreat defensefeedsEndpointwhere mail lands

The first page compares EPP and EDR, the two halves of modern endpoint security. The second page covers management, inventory and posture, which decide whether a device is trusted at all.

The next pages are product focused. Secure Client and Malware Analytics show the agent and the sandbox, and Secure Endpoint configuration and events teach you to set up policy and to read alerts.

The last page covers email threat defense, because email is the main delivery route for malware and phishing, and it connects the endpoint story to the user.

Note

Many exam scenarios cross these pages, for example a phishing mail that leads to a detection on a laptop that then fails a posture check.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams and examples.
  • What to remember for the exam: the facts to memorise.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

If you can, use a trial of the products to see a policy and an event. Reading a real detection event makes the field names much easier to remember.

Ready for more practice?

The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.