5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing a Cisco Secure Endpoint event for a file named 'test.exe'. The event status is 'Quarantined'. The analyst has determined that the file is actually a legitimate testing tool used by the development team. What should the analyst do?

   • ALeave the file quarantined to be safe
   • BChange the event status to 'Clean' without restoring the file
   • CRestore the file and add it to the allow list
   • DDelete the file from the endpoint
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the lifecycle of a malware detection event, what typically occurs after the initial detection and before the final disposition?

   • ADeletion
   • BInvestigation
   • CRemediation
   • DQuarantine
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst observes three Cisco Secure Endpoint events over the past hour. Event 1: a trojan on a workstation in the HR department. Event 2: a trojan on a workstation in the finance department. Event 3: a trojan on a workstation in the IT department. All three events involve files with different hashes but similar names (e.g., 'invoice.pdf.exe', 'resume.pdf.exe', 'report.pdf.exe'). What is the most likely conclusion?

   • AThe events are false positives because the file names are similar
   • BA coordinated phishing campaign is targeting multiple departments with different malware variants
   • CThe same malware is spreading across the network
   • DThe events are unrelated and should be investigated separately
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which malware category is characterized by encrypting a victim's files and demanding payment for the decryption key?

   • ASpyware
   • BRansomware
   • CTrojan
   • DAdware
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is investigating a Cisco Secure Endpoint event for a file named 'data_export.exe'. The event details include the SHA-256 hash, the file name, and the affected endpoint. The detection technology is 'Signature-Based'. The analyst wants to determine if this file has been seen elsewhere in the organization. What is the most effective way to do this?

   • ASearch for the SHA-256 hash in the Cisco Secure Endpoint console
   • BSearch for the detection technology in the Cisco Secure Endpoint console
   • CSearch for the file name in the Cisco Secure Endpoint console
   • DSearch for the affected endpoint in the Cisco Secure Endpoint console
   Reveal Solution Discussion Select an answer first