Cisco Certified Internetwork Expert (CCIE) Practice Test

Which statement about the Cisco AMP Virtual Private Cloud Appliance in air-gap mode is true?

1. The appliance can perform disposition lookup against either the Protect DB or the AMP public cloud

2. The appliance evaluates files against the threat intelligence and disposition information residing on the Update Host

3. The Update Host automatically downloads updates and deploys them to the Protect DB daily

4. The appliance can perform disposition lookups against the Protect DB without an Internet Connection

The correct answer is: The appliance can perform disposition lookups against the Protect DB without an Internet Connection

The assertion that the appliance can perform disposition lookups against the Protect DB without an Internet Connection is accurate because, in air-gap mode, the Cisco AMP Virtual Private Cloud Appliance operates in a secure environment where it does not have access to the public internet. This mode is specifically designed for situations where security is paramount, and the risk of exposing sensitive data to external sources needs to be minimized. In this mode, the Protect DB, which holds disposition information relevant to threat intelligence, is fully accessible by the appliance locally. This means that even without an internet connection, the appliance can effectively evaluate files based on the already available disposition information in the Protect DB. This capability ensures continued operational efficacy despite network isolation. Other statements do not align with the operational restrictions and functionalities of air-gap mode. For instance, relying on the AMP public cloud or external updates goes against the principle of air-gap protection. Additionally, while the Update Host plays a role in regular updates, in air-gap scenarios, automatic downloads and deployments to the Protect DB would not occur as the appliance is disconnected from the internet and cannot communicate with external sources for updates.