SNCF — Securing Networks with Firepower — Question 139

What is the RTC workflow when the infected endpoint is identified?

Answer options

• A. Cisco ISE instructs Cisco AMP to contain the infected endpoint.
• B. Cisco ISE instructs Cisco FMC to contain the infected endpoint.
• C. Cisco FMC instructs Cisco ISE to contain the infected endpoint.
• D. Cisco AMP instructs Cisco FMC to contain the infected endpoint.

Correct answer: C

Explanation

The correct answer is C because Cisco FMC is responsible for coordinating containment actions and instructs Cisco ISE to execute the containment of the infected endpoint. The other options incorrectly attribute the containment action to the wrong components, which do not have the primary role in this specific workflow.