A Cisco Secure Endpoint event for a file named 'invoice.pdf.exe' is enriched with threat intelligence showing it is part of a campaign targeting the finance sector. The file has a global prevalence of 'Very Low'. The severity is 7. What is the most appropriate response?

Quarantine the file and investigate the endpoint for further compromise

Allow the file because its global prevalence is very low

Increase the severity to 10 to trigger a more aggressive response

Ignore the event because it is a false positive

An analyst is reviewing a Cisco Secure Endpoint event for a file named 'legit_app.exe'. The detection technology is 'Behavioral'. The file was flagged because it attempted to modify system registry keys and create a scheduled task. However, the analyst knows this is a legitimate application that performs these actions for updates. What is the best course of action?

Add the file to the allow list to prevent future behavioral detections

Ignore the event and take no action

Change the detection technology to signature-based

Quarantine the file because it exhibits malicious behavior

An analyst is reviewing a Cisco Secure Endpoint event for a file named 'keylogger.exe' detected as spyware with severity 8. The file was detected on a workstation in the legal department. The analyst needs to determine the appropriate response. What is the most important consideration?

The global prevalence of the file

The severity and the sensitivity of the data on the affected endpoint

The detection technology used to identify the file

The file name and its similarity to known spyware

CiscoCertified Network Professional Security

Domain 5Objective 6

5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 2)

Part of the Endpoint Protection and Detection domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

15%of the exam

Questions 6–10

6application · medium
A Cisco Secure Endpoint event for a file named 'invoice.pdf.exe' is enriched with threat intelligence showing it is part of a campaign targeting the finance sector. The file has a global prevalence of 'Very Low'. The severity is 7. What is the most appropriate response?
Select an answer first
7expert · hard
An analyst is reviewing a Cisco Secure Endpoint event for a file named 'legit_app.exe'. The detection technology is 'Behavioral'. The file was flagged because it attempted to modify system registry keys and create a scheduled task. However, the analyst knows this is a legitimate application that performs these actions for updates. What is the best course of action?
Select an answer first
8foundation · easy
In a Cisco Secure Endpoint malware event, which detail helps an analyst understand the scope of the infection by identifying which system was affected?
Select an answer first
9expert · hard
An analyst is reviewing a Cisco Secure Endpoint event for a file named 'keylogger.exe' detected as spyware with severity 8. The file was detected on a workstation in the legal department. The analyst needs to determine the appropriate response. What is the most important consideration?
Select an answer first
10foundation · easy
Which remediation action should be taken when a malware detection event indicates a file is malicious and actively spreading?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 2)

Questions 6–10

A Cisco Secure Endpoint event for a file named 'invoice.pdf.exe' is enriched with threat intelligence showing it is part of a campaign targeting the finance sector. The file has a global prevalence of 'Very Low'. The severity is 7. What is the most appropriate response?

In a Cisco Secure Endpoint malware event, which detail helps an analyst understand the scope of the infection by identifying which system was affected?

An analyst is reviewing a Cisco Secure Endpoint event for a file named 'keylogger.exe' detected as spyware with severity 8. The file was detected on a workstation in the legal department. The analyst needs to determine the appropriate response. What is the most important consideration?

Which remediation action should be taken when a malware detection event indicates a file is malicious and actively spreading?

Keep studying — Endpoint Protection and Detection