4.5 Interpret Cisco Secure Access Investigate Scores and Indicators 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security policy defines that any domain with an Investigate score of 70 or higher must be blocked, and any domain with a score below 70 is allowed. A user attempts to access a domain with a score of 69. What should the security team do according to the policy?

   • ABlock the domain because any score above 60 is considered high risk.
   • BBlock the domain because it is close to the threshold and could be risky.
   • CAllow the domain because it is below the blocking threshold of 70.
   • DAllow the domain but require additional authentication.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization is correlating Cisco Secure Access Investigate scores with their SIEM alerts. They notice that a domain with a score of 20 has triggered a high-severity alert for data exfiltration. What should the analyst do?

   • AInvestigate the alert further because the low score does not rule out malicious activity.
   • BIgnore the alert because the domain has a low score and is likely safe.
   • CLower the severity of the alert because the domain score is low.
   • DImmediately block the domain because the alert is high severity.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is reviewing a domain with an Investigate score of 60. The domain has a threat category of 'Malware' and is associated with a known malware family. However, the domain is also used by a legitimate software vendor for updates. What is the most appropriate action?

   • AAllow the domain because it is used by a legitimate vendor.
   • BInvestigate the domain's history and the specific malware family to determine if the domain is compromised or if the score is a false positive.
   • CBlock the domain immediately because it is associated with malware.
   • DIgnore the threat category because the score is only 60.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an incident response investigation, an analyst queries Cisco Secure Access Investigate for a malicious IP address. The results show a high Investigate score, a threat category of 'Command and Control', and several related domains that were recently registered. What is the most appropriate interpretation of these indicators?

   • AThe IP is definitely compromised and should be isolated from the network immediately.
   • BThe IP is likely part of a C2 infrastructure, and the related domains may be additional C2 endpoints.
   • CThe threat category is more important than the score, so the score can be ignored.
   • DThe related domains are probably benign because they were recently registered.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An incident response team is investigating a host that is communicating with an external IP. Cisco Secure Access Investigate shows a score of 75, a threat category of 'Botnet', and a related domain that is also categorized as 'Botnet'. However, the host is a critical server that cannot be taken offline. What is the most appropriate immediate action?

   • ABlock the IP and domain but allow the host to continue communicating with other systems.
   • BTake the server offline immediately to stop the botnet communication.
   • CIsolate the host from the network while allowing the server to remain powered on, and block the IP and domain at the firewall.
   • DDo nothing because the server is critical and cannot be disrupted.
   Reveal Solution Discussion Select an answer first