4.5 Interpret Cisco Secure Access Investigate Scores and Indicators 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a data source that contributes to Cisco Secure Access Investigate scores?

   • ACisco Talos threat intelligence
   • BThe domain's page load time
   • CThe domain's social media followers
   • DThe domain's website color scheme
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why does Cisco Secure Access Investigate use multiple data sources to calculate scores?

   • ATo reduce the cost of maintaining the service
   • BTo ensure that all domains are scored equally
   • CTo eliminate the need for human analysts
   • DTo increase the accuracy and reliability of the risk assessment
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is reviewing a domain that has an Investigate score of 55. The domain is used for a marketing campaign and has been accessed by many employees. The team is considering whether to block it. What is the most important factor to consider?

   • AThe domain should be blocked because any score above 50 is considered high risk.
   • BThe domain should be allowed because it is used for a legitimate marketing campaign.
   • CThe score of 55 indicates medium risk, so the team should investigate the domain's reputation and any related indicators before deciding.
   • DThe domain should be blocked because it is used by many employees, increasing the attack surface.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is investigating a security event where an internal host made repeated connections to an external IP. Cisco Secure Access Investigate returns a score of 95 for that IP, with a threat category of 'Malware' and a related domain that matches the host's DNS queries. What is the most appropriate correlation to support incident response?

   • AThe host is likely infected with malware that is communicating with a known malicious IP.
   • BThe host is a victim of a DDoS attack, and the IP is the attacker's source.
   • CThe host is performing a legitimate software update, and the IP is a trusted update server.
   • DThe event is a false positive because the IP has a related domain.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst at a financial firm is triaging a suspicious domain that was observed in an email link. Cisco Secure Access Investigate returns a score of 85 for the domain. The analyst needs to decide whether to block the domain immediately or allow it while monitoring. The firm's policy is to block any domain with a score above 80. What should the analyst do?

   • AAllow the domain and monitor it because the score is below 100, which is the only threshold that warrants blocking.
   • BAllow the domain because Investigate scores are only informational and not used for enforcement.
   • CBlock the domain immediately because the score exceeds the firm's threshold of 80.
   • DBlock the domain only if the threat category is malware, regardless of the score.
   Reveal Solution Discussion Select an answer first