5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company wants to enforce different network access policies for employees and contractors. They have ISE deployed. Which ISE feature should they use to classify users and enforce policies?

   • ASecure Endpoint groups
   • BSecurity group tags (SGTs)
   • CUmbrella destination lists
   • DFirepower access control policies
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations team wants to automate the retrieval of Umbrella security events and XDR incidents into a custom dashboard. They need to authenticate to both APIs. What is the best practice for managing API credentials?

   • AStore credentials in a secure secret management system and use them in the automation script
   • BShare the credentials in a team chat for easy access
   • CUse the same API key for both platforms
   • DHardcode the credentials in the script for simplicity
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst receives an alert from Cisco Secure Endpoint about a file that has been quarantined on several endpoints. The analyst wants to determine if the file is part of a larger campaign by checking if the file's hash has been seen in other environments and if it is related to any known indicators. Which action should the analyst take?

   • AUse the Umbrella API to check DNS logs for the hash
   • BUse the Secure Endpoint API to search for the hash across all endpoints
   • CSubmit the file hash to Cisco Secure Malware Analytics for analysis
   • DUse Firepower to search for the hash in network traffic
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations team uses Cisco Secure Endpoint, Firepower, and Umbrella. They want a single API-driven workflow that pulls alerts from all three products, correlates them into a single incident, and triggers a response action. Which Cisco platform is designed to provide this cross-product correlation and orchestration capability?

   • ACisco Identity Services Engine
   • BCisco Firepower Management Center
   • CCisco Secure Malware Analytics
   • DCisco XDR
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How can APIs for Cisco security platforms be used to automate security operations?

   • ABy replacing the need for any human security analysts
   • BBy allowing scripts to programmatically retrieve threat data and update security policies across platforms
   • CBy automatically patching all operating systems on the network
   • DBy providing a graphical interface for manual configuration of security devices
   Reveal Solution Discussion Select an answer first