5. Describe the Capabilities of Cisco Security Platforms and APIs (XDR, Firepower, Umbrella, Secure Endpoint, ISE, and Secure Malware Analytics) 200-901 Practice Questions (Page 9)

Questions 41–42

1. 41expert · hard

   A security operations center uses Cisco Secure Endpoint, Firepower, and Umbrella. They receive an alert from Secure Endpoint about a suspicious process on a laptop. The analyst wants to see if the same process was observed on other endpoints, whether the firewall blocked any related traffic, and if the domain associated with the process was queried by other users. They want to do this from a single interface without manually querying each console. Which approach best meets this need?

   • AUse Cisco XDR to correlate the alert with telemetry from all three products
   • BUse Firepower Management Center to view all events
   • CWrite a script that queries each product's API and merges the results
   • DUse Secure Endpoint's console to search all logs
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which action is an example of threat containment provided by Cisco Secure Endpoint?

   • AIsolating an infected endpoint from the network to prevent lateral movement
   • BBlocking a malicious domain at the DNS level
   • CSandboxing a suspicious file in a virtual environment
   • DEnforcing network access policies based on user identity
   Reveal Solution Discussion Select an answer first