5.4 Describe Endpoint Protection and Detection Security with Solutions Such as Cisco Secure Client and Cisco Secure Malware Analytics 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What benefit does integrating Cisco Secure Malware Analytics with endpoint protection provide?

   • AIt eliminates the need for antivirus software on the endpoint.
   • BIt automatically blocks all network traffic from the endpoint.
   • CIt provides real-time threat intelligence that can be used to update endpoint detection rules.
   • DIt replaces the need for a firewall on the network.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which integrated capability in Cisco Secure Client provides protection by inspecting and controlling web traffic from the endpoint?

   • AWeb security
   • BData Loss Prevention (DLP)
   • CNetwork Access Control (NAC)
   • DIntrusion Prevention System (IPS)
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security operations center (SOC) is evaluating Cisco Secure Malware Analytics to handle a high volume of alerts. The team wants to prioritize which files to analyze first. They have a mix of known-good files, known-malicious files, and unknown files. The SOC lead wants to minimize the number of files that need full sandboxing. Which approach should the team use to triage the files?

   • AManually review each file's metadata and decide based on the file extension
   • BUse the Secure Client Posture module to block all unknown files before they reach the SOC
   • CFirst check file hashes against Threat Grid's reputation database, then submit only unknown files for sandboxing
   • DSubmit all files to Threat Grid for full sandboxing to ensure no malware is missed
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is planning to deploy Cisco Secure Client to a mix of Windows, macOS, and Linux endpoints. The IT team wants to ensure that the deployment is consistent and that all modules are configured from a central location. Which deployment approach should they use?

   • AUse a software distribution tool to deploy the client and manage the configuration via a central policy server
   • BUse the VPN module only, as it is the only module that supports all operating systems
   • CDeploy the client only on Windows endpoints and use a different solution for macOS and Linux
   • DManually install the client on each endpoint and configure the modules locally
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A malware analyst has submitted a suspicious executable to Cisco Secure Malware Analytics. The report indicates that the executable attempts to communicate with an IP address that is flagged as malicious. What is the most important piece of information the analyst should extract from the report for immediate defensive action?

   • AThe file's compilation timestamp
   • BThe file's size
   • CThe file's SHA-256 hash
   • DThe malicious IP address
   Reveal Solution Discussion Select an answer first