5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user reports that a file named 'project_notes.docm' was quarantined by Cisco Secure Endpoint. The event details show the detection technology as 'Behavioral'. The file was not previously known to be malicious. Why did the detection occur?

   • AThe file was flagged by a machine learning model based on its static characteristics
   • BThe file was downloaded from a known malicious URL
   • CThe file's hash matched a known malware signature in the database
   • DThe file exhibited suspicious behavior, such as attempting to execute macros and modify system files
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst sees a Cisco Secure Endpoint event for a file named 'unknown_script.ps1'. The detection technology is listed as 'Machine Learning'. The file has a low prevalence score and is not associated with any known threat actor. What is the most likely reason for the detection?

   • AThe file's hash matched a known malware signature
   • BThe file's characteristics, such as obfuscation and suspicious API calls, were classified as malicious by the ML model
   • CThe file was flagged by a behavioral analysis sandbox
   • DThe file was downloaded from a URL with a poor reputation
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security analyst is reviewing a Cisco Secure Endpoint malware event and sees the malware family classified as 'Trojan.GenericKD'. Which category of malware does this event represent?

   • ATrojan
   • BSpyware
   • CWorm
   • DRansomware
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst at a hospital reviews Cisco Secure Endpoint events and sees two detections: one for a file named 'invoice_scan.exe' flagged as a trojan with severity 7, and another for 'photo_editor_setup.exe' flagged as a PUA (potentially unwanted application) with severity 2. The hospital has a policy that any file with a severity of 6 or higher must be quarantined immediately. What should the analyst do with these two files?

   • AQuarantine 'photo_editor_setup.exe' and allow 'invoice_scan.exe'
   • BQuarantine both files because both are flagged as malware
   • CAllow both files because neither has been confirmed by a human analyst
   • DQuarantine 'invoice_scan.exe' and allow 'photo_editor_setup.exe'
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A Cisco Secure Endpoint event is assigned a severity level of 'High'. What does this severity level indicate to a security analyst?

   • AThe event is only relevant to the endpoint's local administrator.
   • BThe event is informational and requires no action.
   • CThe event requires immediate attention due to potential significant impact.
   • DThe event is a false positive and can be ignored.
   Reveal Solution Discussion Select an answer first