5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which piece of information is typically included in a Cisco Secure Endpoint malware detection event to uniquely identify the malicious file?

   • AFile hash
   • BEndpoint hostname
   • CNetwork gateway IP
   • DUser's email address
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is investigating a Cisco Secure Endpoint event for a file named 'report.pdf.exe'. The event is enriched with threat intelligence showing it is associated with the 'APT29' threat actor and has been observed in a campaign targeting the healthcare sector. The severity is 8. What does this enrichment add to the analyst's understanding?

   • AIt provides context about the threat actor and campaign, helping to assess the risk and potential impact
   • BIt automatically triggers a quarantine action on all endpoints
   • CIt confirms the file is definitely malicious and requires no further investigation
   • DIt indicates the file is a false positive because it is associated with a known campaign
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is investigating a series of Cisco Secure Endpoint events. Event A: a trojan with severity 6 on a user workstation. Event B: a spyware with severity 7 on a file server. Event C: a ransomware with severity 9 on a backup server. The team has limited resources and can only fully investigate one event immediately. Which event should they prioritize?

   • AEvent C, because ransomware on a backup server poses the highest risk of data loss and operational impact
   • BInvestigate all three events simultaneously
   • CEvent A, because trojans are more common and likely to spread
   • DEvent B, because spyware on a file server could exfiltrate sensitive data
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which detection technology is most effective at identifying previously unknown malware by analyzing its actions rather than its code?

   • AFile hash matching
   • BBehavioral detection
   • CReputation-based detection
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is triaging multiple Cisco Secure Endpoint events. Event 1: a trojan with severity 8 on a domain controller. Event 2: a PUA with severity 4 on a marketing workstation. Event 3: a spyware with severity 6 on a finance workstation. Which event should the analyst investigate first?

   • AEvent 2, because it is a PUA and might be a false positive
   • BEvent 3, because spyware is more dangerous than a trojan
   • CInvestigate all events at the same time
   • DEvent 1, because it has the highest severity and is on a critical asset
   Reveal Solution Discussion Select an answer first