5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary role of Cisco XDR in a security architecture?

   • ATo manage firewall rules and VPN configurations across the organization
   • BTo replace all existing security products with a single unified agent
   • CTo block malicious domains at the DNS layer before a connection is established
   • DTo provide a centralized platform that correlates telemetry from multiple security products to detect and respond to threats
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which feature is characteristic of a threat-focused next-generation firewall (NGFW) such as Cisco Firepower?

   • AIt is primarily used for endpoint malware detection and response
   • BIt only provides DNS-layer filtering to block malicious domains
   • CIt relies solely on port-based access control lists to filter traffic
   • DIt integrates intrusion prevention, application visibility, and advanced threat detection with traditional firewall functions
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a Firepower NGFW and ISE deployed. They want to enforce a policy that blocks access to a sensitive server for users who are not in the 'Finance' group. The firewall should receive the user identity from ISE. Which integration method should they use?

   • AConfigure Umbrella to send identity to Firepower
   • BUse Secure Endpoint to share user identity
   • CConfigure ISE to pass user identity to Firepower via pxGrid
   • DUse the Firepower API to manually add user IP addresses
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team needs to retrieve the current configuration of all access control rules from their Firepower NGFW to audit against corporate policy. They want to automate this retrieval using a script. Which API should they use?

   • ACisco Umbrella Management API
   • BCisco Secure Endpoint API
   • CFirepower Management Center REST API
   • DCisco ISE REST API
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A network team uses Cisco ISE for network access control. They want to automate the process of updating a specific endpoint's authorization policy when a vulnerability scan flags it as critical. The vulnerability scanner can only send syslog messages. Which approach should they use?

   • ADirectly configure ISE to receive syslog and update policies natively
   • BUse the Umbrella API to update ISE policies
   • CUse the Firepower API to update ISE policies
   • DUse a syslog collector that parses the message and calls the ISE REST API to update the endpoint's policy
   Reveal Solution Discussion Select an answer first