5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A DevOps team wants to automate the process of adding newly provisioned internal domains to Cisco Umbrella's block list. They plan to use a script that calls an API. Which API should they use?

   • ACisco Secure Endpoint API
   • BCisco Umbrella Enforcement API
   • CCisco ISE REST API
   • DCisco Firepower Management Center API
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to retrieve the list of all endpoints that have been isolated by Cisco Secure Endpoint in the last 24 hours. They want to automate this retrieval using a script. Which API should they use?

   • ACisco ISE REST API
   • BCisco Firepower Management Center API
   • CCisco Secure Endpoint API
   • DCisco Umbrella Reporting API
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to enforce network access policies based on the identity and posture of devices connecting to the wired and wireless network. They need to integrate with their existing Active Directory and automate the process of quarantining non-compliant devices. Which Cisco platform should they use?

   • ACisco Umbrella
   • BCisco Firepower NGFW
   • CCisco Secure Malware Analytics
   • DCisco Identity Services Engine (ISE)
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst wants to automatically retrieve the list of endpoints that have been quarantined by Secure Endpoint and then enrich that list with threat intelligence from Secure Malware Analytics. They plan to write a script. What is the correct sequence of API calls?

   • ACall Threat Grid API first to get quarantined endpoints
   • BCall Umbrella API to get quarantined endpoints
   • CCall Secure Endpoint API to get quarantined endpoints, then call Threat Grid API to enrich each endpoint's file hashes
   • DCall Firepower API to get quarantined endpoints
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst needs to automatically isolate a compromised endpoint from the network as soon as a high-severity alert is triggered by the endpoint's behavior. Which Cisco platform's API should the analyst use to perform this containment action?

   • ACisco Firepower Management Center
   • BCisco Secure Malware Analytics
   • CCisco Secure Endpoint
   • DCisco Umbrella
   Reveal Solution Discussion Select an answer first