4.5 Interpret Cisco Secure Access Investigate Scores and Indicators 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In Cisco Secure Access Investigate, a domain with a score of 90 out of 100 would typically be categorized as:

   • AModerate risk
   • BLow risk
   • CUnknown risk
   • DHigh risk
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How can a security analyst use Investigate scores to support incident response?

   • ABy using the score to predict future attacks with certainty
   • BBy correlating the score of a domain with security events to determine if the domain is a likely threat
   • CBy using the score to determine the exact attacker's identity
   • DBy using the score to automatically remediate all affected systems
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is investigating a domain that has a high Investigate score but is not present in any of the organization's logs. The analyst wants to understand why the score is high. Which approach is most effective?

   • AReview the Investigate details, including the data sources and indicators that contributed to the score.
   • BIgnore the domain because it is not in the organization's logs.
   • CBlock the domain immediately because the score is high.
   • DAssume the score is a false positive because the domain is not in the logs.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is evaluating the reliability of Cisco Secure Access Investigate scores for a domain that has no historical data. The team wants to understand what data sources contribute to the score. Which statement accurately describes the data sources used by Investigate?

   • AInvestigate relies solely on the organization's own firewall logs to calculate scores.
   • BInvestigate uses only the domain's WHOIS registration data to determine its score.
   • CInvestigate uses a combination of threat intelligence feeds, DNS data, and web reputation sources to calculate scores.
   • DInvestigate scores are based only on the domain's age and registration date.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of applying score thresholds in Cisco Secure Access Investigate?

   • ATo determine the exact age of a domain
   • BTo replace the need for manual analysis by security analysts
   • CTo categorize domains into risk levels and guide appropriate security actions
   • DTo automatically block all domains with any score above zero
   Reveal Solution Discussion Select an answer first