5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization has Cisco Secure Endpoint deployed. They want to use Cisco XDR to correlate endpoint alerts with network alerts from Firepower. However, the Secure Endpoint API token they have only has read-only permissions. What is the impact on the XDR integration?

   • AXDR integration will fail because Secure Endpoint API does not support read-only tokens
   • BXDR can ingest alerts but cannot trigger containment actions on endpoints
   • CXDR cannot ingest any data from Secure Endpoint
   • DXDR can trigger containment actions but cannot ingest alerts
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations center uses Cisco Secure Endpoint and Firepower. They want to implement Cisco XDR to correlate alerts, but they have a constraint: they must use only APIs to ingest data and cannot install additional software on endpoints. Which approach is feasible?

   • ADeploy a new endpoint agent from Cisco XDR to collect telemetry
   • BUse the ISE API to correlate alerts from Secure Endpoint and Firepower
   • CUse the Umbrella API to pull data from Secure Endpoint and Firepower
   • DUse the Secure Endpoint and Firepower APIs to send telemetry to Cisco XDR
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is evaluating Cisco XDR to reduce alert fatigue. They currently receive alerts from Firepower and Secure Endpoint. They want XDR to automatically create a single incident when related alerts from both sources occur. What is the primary capability of XDR that enables this?

   • ACross-product alert correlation
   • BCentralized firewall policy management
   • CEndpoint isolation
   • DDNS-layer blocking
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to use ISE to dynamically assign users to different security groups, and then have Firepower enforce different policies based on those groups. Which integration should they configure?

   • AUmbrella to Firepower via API for group policies
   • BFirepower to ISE via REST API for user groups
   • CSecure Endpoint to Firepower via API for group policies
   • DISE to Firepower via pxGrid for security group tags
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to block access to known malicious domains at the DNS layer before users' devices connect to them. They also want to automate the retrieval of DNS query logs for security analysis. Which Cisco platform should they use?

   • ACisco Secure Endpoint
   • BCisco Identity Services Engine
   • CCisco Firepower NGFW
   • DCisco Umbrella
   Reveal Solution Discussion Select an answer first