Question

A security engineer is deploying Cisco Secure Endpoint connectors to 3,000 Windows workstations. Leadership is concerned that aggressive blocking could disrupt line-of-business applications during the initial rollout. The engineer needs the connectors to fully monitor file activity, generate detections and events, and populate device trajectory, but NOT quarantine or block any files while the team validates behavior against legitimate applications. Which connector engine/policy configuration meets these requirements during the pilot phase?

Accepted Answer

Set the policy's conviction mode to Audit for the file and malware engines, keeping detection and event reporting active without automated quarantine

Answer

Disable the Secure Endpoint connector's cloud communication so no verdicts are returned and files cannot be quarantined

Answer

Configure a Simple Custom Detection list containing all application hashes to whitelist them from scanning

Answer

Enable Protect mode but set the file conviction cache TTL to zero so no files are blocked