4.5 Interpret Cisco Secure Access Investigate Scores and Indicators 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security operations center is correlating Investigate scores with endpoint alerts. They find that a domain with a score of 30 has been associated with multiple endpoint alerts for suspicious PowerShell activity. The domain is not on any blocklist. What is the most likely explanation?

   • AThe endpoint alerts are false positives because the domain score is low.
   • BThe domain is safe and the alerts are unrelated to it.
   • CThe domain may be newly malicious or the score may not yet reflect the latest threat intelligence.
   • DThe domain score is incorrect and should be manually set to a high value.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a policy to block domains with an Investigate score above 80. A domain used for a critical business application has a score of 82. The application is essential for operations, and blocking it would cause significant downtime. What is the best approach?

   • ALower the threshold to 90 to avoid blocking this domain.
   • BTemporarily allow the domain while investigating the score and implementing additional monitoring.
   • CPermanently allowlist the domain because it is critical for business.
   • DBlock the domain immediately to comply with the policy, accepting the downtime.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is evaluating a domain that has a high Investigate score of 92. However, the domain is a well-known legitimate service used by the company for business operations. The team is concerned about blocking it. What is the most appropriate course of action?

   • ABlock the domain immediately because the score is above the high-risk threshold.
   • BAllow the domain because it is a known legitimate service, regardless of the score.
   • CInvestigate the reason for the high score, such as a recent compromise or malicious activity, before deciding to block.
   • DCreate a permanent allowlist entry for the domain to prevent future alerts.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What type of information does the 'related domains' indicator in Cisco Secure Access Investigate provide?

   • ADomains that are likely controlled by the same entity or used in the same campaign
   • BDomains that are popular among users who visit the queried domain
   • CDomains that have similar spelling to the queried domain
   • DDomains that are hosted on the same web server as the queried domain
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When correlating Investigate indicators with a security event, which of the following is a key benefit?

   • AIt automatically blocks all related domains
   • BIt eliminates the need for further investigation
   • CIt helps confirm whether the event is part of a known malicious campaign
   • DIt guarantees the event is a false positive
   Reveal Solution Discussion Select an answer first