5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has multiple Firepower NGFWs deployed across branch offices. The security team wants to use a REST API to push a new intrusion prevention policy to all devices from a central location, and then verify that the policy was applied. Which Cisco platform should they interact with via API?

   • AFirepower Management Center
   • BCisco Umbrella dashboard
   • CCisco XDR API
   • DCisco Secure Endpoint console
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst receives an unknown executable file and wants to determine its behavior in a safe environment. They need to automate the submission of the file to a sandbox and retrieve the resulting indicators of compromise (IOCs) via an API. Which Cisco platform should they use?

   • ACisco Identity Services Engine
   • BCisco Secure Endpoint
   • CCisco Secure Malware Analytics (Threat Grid)
   • DCisco Firepower NGFW
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which capability is a key benefit of Cisco XDR compared to using separate security tools in isolation?

   • AIt provides a single pane of glass for managing firewall rules and NAT policies
   • BIt eliminates the need for any endpoint security software
   • CIt correlates events across different security products to identify multi-stage attacks that might otherwise go unnoticed
   • DIt automatically patches all vulnerabilities across the network
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company uses Cisco Umbrella for DNS security. They want to automatically block a newly discovered malicious domain across all users within minutes of the domain being identified by their threat intelligence team. The threat intel team uses Cisco Secure Malware Analytics to analyze samples. What is the most efficient way to achieve this?

   • AManually add the domain to each user's local hosts file
   • BUse Secure Malware Analytics to block the domain
   • CWait for Umbrella's threat intelligence to automatically update
   • DUse the Umbrella API to add the domain to the block list programmatically
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations team is implementing Cisco XDR. They have Cisco Umbrella and ISE in their environment. They want XDR to correlate DNS events from Umbrella with authentication events from ISE. However, they are concerned about the privacy of user data. What should they do to ensure that only necessary data is sent to XDR?

   • AUse the Umbrella API to manually send only DNS events to XDR
   • BDisable ISE integration and rely only on Umbrella data
   • CConfigure data filtering in the XDR integration settings to limit the telemetry sent
   • DUse the ISE API to send all authentication logs to XDR without filtering
   Reveal Solution Discussion Select an answer first