4.5 Interpret Cisco Secure Access Investigate Scores and Indicators 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an incident investigation, an analyst reviews Cisco Secure Access Investigate results for a domain that was accessed by multiple internal hosts. The domain has a score of 45, a threat category of 'Phishing', and several related domains that are also categorized as phishing. What should the analyst conclude?

   • AThe domain is likely part of a phishing campaign, and the related domains should also be investigated.
   • BThe domain is safe because the score is below 50.
   • CThe domain is a false positive because it has a moderate score.
   • DThe related domains are irrelevant to the investigation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following best describes how Cisco Secure Access Investigate calculates a domain's score?

   • ABy performing a single real-time scan of the domain's content
   • BBy aggregating and correlating data from multiple threat intelligence sources
   • CBy measuring the domain's response time to DNS queries
   • DBy counting the number of blacklists that include the domain
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization has a policy that domains with an Investigate score above 70 are blocked, and domains with a score between 40 and 70 are monitored. A domain with a score of 72 is accessed by a user, and the user reports that the domain is required for a time-sensitive client project. What is the best action?

   • ALower the threshold to 75 to allow this domain.
   • BAllow the domain because the user says it is needed for a client project.
   • CMonitor the domain because it is close to the threshold.
   • DBlock the domain because it exceeds the threshold, but allow the user to request an exception through a formal process.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is comparing two domains. Domain A has a score of 80 with a threat category of 'Malware' and multiple related domains. Domain B has a score of 85 but no threat category or related domains. The analyst needs to prioritize which domain to block first. What should the analyst consider?

   • ADomain A should be prioritized because the threat category and related domains provide more context for immediate action.
   • BNeither domain should be blocked because the scores are not above 90.
   • CDomain B should be prioritized because its score is higher.
   • DBoth domains should be blocked simultaneously because they both have high scores.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst notices that a domain has a high Investigate score but no related domains and no threat category listed. The analyst is unsure how to interpret this. What is the most likely explanation?

   • AThe domain is definitely safe because it has no threat category.
   • BThe domain is likely a newly registered domain with no history.
   • CThe score may be based on reputation data from multiple sources, even if specific indicators are not listed.
   • DThe score is a false positive because there are no related domains.
   Reveal Solution Discussion Select an answer first