5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which output is typically provided by Cisco Secure Malware Analytics after analyzing a file?

   • AA list of all users who have accessed the file on the network
   • BA detailed report of the file's behavior, including network indicators and file system changes
   • CA set of firewall rules to block the file's command-and-control server
   • DA DNS record to block the domain associated with the file
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which capability is part of Cisco Umbrella's secure web gateway (SWG) functionality?

   • AIt performs signature-based malware scanning on endpoints
   • BIt provides centralized management for firewall policies across multiple sites
   • CIt provides network access control for devices attempting to join the network
   • DIt provides URL filtering and policy enforcement for web traffic
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A malware analyst wants to automate the submission of suspicious files to Cisco Secure Malware Analytics and retrieve the analysis report. They need to ensure that the file is analyzed only in a private environment and not shared with the public threat intelligence community. Which API parameter should they set?

   • AUse the 'network' parameter to disable internet access
   • BSet the 'sample' flag to true in the submission request
   • CSet the 'private' flag to true in the submission request
   • DUse the 'vm' parameter to select a private VM
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary role of Cisco Identity Services Engine (ISE) in a network?

   • ATo provide centralized management of firewall policies
   • BTo provide DNS-layer security for all network traffic
   • CTo provide network access control and policy enforcement based on user identity and device posture
   • DTo provide advanced malware protection for endpoints
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to automatically pull DNS query logs from Cisco Umbrella and endpoint event logs from Cisco Secure Endpoint into a central SIEM. They plan to write a script that polls both APIs. What is the primary consideration when designing this integration?

   • AThe APIs only support real-time streaming, not polling
   • BThe script must use the same API key for both platforms
   • CThe SIEM must be hosted in the same cloud region as the APIs
   • DEach platform has its own API authentication and data schema
   Reveal Solution Discussion Select an answer first